diff --git a/nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json b/nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json
index c7f58fd5799ad..0f1ebe5749c67 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json
@@ -91,6 +91,7 @@
         "adapter.auto-port-config": {
           "mode": "dsp",
           "monitor": false,
+          "control": false,
           "position": "unknown"
         }
       }
@@ -109,6 +110,7 @@
         "adapter.auto-port-config": {
           "mode": "dsp",
           "monitor": false,
+          "control": false,
           "position": "unknown"
         }
       }
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 653d5555eb144..953e9887f5a6e 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -167,6 +167,9 @@ in stdenv.mkDerivation rec {
     "-DDISABLE_DYNAMIC_LOADING_FFMPEG=ON"
     "-Daudacity_conan_enabled=Off"
     "-Daudacity_use_ffmpeg=loaded"
+
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
   doCheck = false; # Test fails
diff --git a/pkgs/applications/audio/in-formant/default.nix b/pkgs/applications/audio/in-formant/default.nix
index 7cf0fb8c14547..5fb36b0345060 100644
--- a/pkgs/applications/audio/in-formant/default.nix
+++ b/pkgs/applications/audio/in-formant/default.nix
@@ -35,6 +35,9 @@ stdenv.mkDerivation rec {
     cp in-formant $out/bin
   '';
 
+  # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=ON" ];
+
   meta = with lib; {
     description = "A real-time pitch and formant tracking software";
     homepage = "https://github.com/in-formant/in-formant";
diff --git a/pkgs/applications/audio/speech-denoiser/default.nix b/pkgs/applications/audio/speech-denoiser/default.nix
index 466457c607dcf..8bce5c83a6912 100644
--- a/pkgs/applications/audio/speech-denoiser/default.nix
+++ b/pkgs/applications/audio/speech-denoiser/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation  {
   nativeBuildInputs = [ pkg-config meson ninja ];
   buildInputs = [ lv2 rnnoise-nu ];
 
-  mesonFlags = ("--prefix=${placeholder "out"}/lib/lv2");
+  mesonFlags = [ "--prefix=${placeholder "out"}/lib/lv2" ];
 
   postPatch = ''
     substituteInPlace meson.build \
diff --git a/pkgs/applications/audio/tenacity/default.nix b/pkgs/applications/audio/tenacity/default.nix
index fbf13c1748ff4..89051e70b5193 100644
--- a/pkgs/applications/audio/tenacity/default.nix
+++ b/pkgs/applications/audio/tenacity/default.nix
@@ -138,6 +138,11 @@ stdenv.mkDerivation rec {
     util-linux
   ];
 
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   meta = with lib; {
     description = "Sound editor with graphical UI";
     homepage = "https://tenacityaudio.org/";
diff --git a/pkgs/applications/emulators/resim/default.nix b/pkgs/applications/emulators/resim/default.nix
index 49d7721174f5f..d69aafcec2bd7 100644
--- a/pkgs/applications/emulators/resim/default.nix
+++ b/pkgs/applications/emulators/resim/default.nix
@@ -17,5 +17,10 @@ stdenv.mkDerivation {
     cp -v vc4emul/vc4emul $out/bin/vc4emul
   '';
 
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   meta.license = lib.licenses.mit;
 }
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index 8acc917b047f8..e079d347181c2 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -128,7 +128,6 @@ in mkDerivation rec {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DWITH_3D=True"
     "-DWITH_PDAL=TRUE"
     "-DPYQT5_SIP_DIR=${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}/PyQt5/bindings"
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index f0cfbda170d9e..fe53f0726b4e0 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -128,7 +128,6 @@ in mkDerivation rec {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DWITH_3D=True"
     "-DWITH_PDAL=TRUE"
     "-DPYQT5_SIP_DIR=${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}/PyQt5/bindings"
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index cd16fe1de0892..1087bba9705e8 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -44,13 +44,6 @@ in mkDerivation rec {
     export QT_PLUGIN_PATH=${qtbase.bin}/${qtbase.qtPluginPrefix}
   '';
 
-  # During build, binaries are called that rely on freshly built
-  # libraries.  These reside in build/lib, and are not found by
-  # default.
-  preBuild = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
-  '';
-
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=Release"
     "-DPARAVIEW_ENABLE_FFMPEG=ON"
diff --git a/pkgs/applications/kde/dolphin.nix b/pkgs/applications/kde/dolphin.nix
index 92d256f477090..b70f4977f587b 100644
--- a/pkgs/applications/kde/dolphin.nix
+++ b/pkgs/applications/kde/dolphin.nix
@@ -27,8 +27,4 @@ mkDerivation {
     wayland qtwayland
   ];
   outputs = [ "out" "dev" ];
-  # We need the RPATH for linking, because the `libkdeinit5_dolphin.so` links
-  # private against its dependencies and without the correct RPATH, these
-  # dependencies are not found.
-  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=OFF" ];
 }
diff --git a/pkgs/applications/misc/audio/soxr/default.nix b/pkgs/applications/misc/audio/soxr/default.nix
index f7c01ce464940..e90ac480eb19f 100644
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@@ -16,13 +16,6 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ]; # headers are just two and very small
 
-  preConfigure =
-    if stdenv.isDarwin then ''
-      export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}"`pwd`/build/src
-    '' else ''
-      export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}"`pwd`/build/src
-    '';
-
   nativeBuildInputs = [ cmake ];
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/edgetx/default.nix b/pkgs/applications/misc/edgetx/default.nix
index 4dfb5b6422fe0..d71c01d4ace90 100644
--- a/pkgs/applications/misc/edgetx/default.nix
+++ b/pkgs/applications/misc/edgetx/default.nix
@@ -29,6 +29,8 @@ mkDerivation rec {
     "-DGTEST_ROOT=${gtest.src}/googletest"
     "-DQT_TRANSLATIONS_DIR=${qttranslations}/translations"
     "-DDFU_UTIL_PATH=${dfu-util}/bin/dfu-util"
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/opentx/default.nix b/pkgs/applications/misc/opentx/default.nix
index e0a7b89424440..e9a526a1f65f5 100644
--- a/pkgs/applications/misc/opentx/default.nix
+++ b/pkgs/applications/misc/opentx/default.nix
@@ -31,6 +31,9 @@ mkDerivation rec {
     # XXX I would prefer to include these here, though we will need to file a bug upstream to get that changed.
     #"-DDFU_UTIL_PATH=${dfu-util}/bin/dfu-util"
     #"-DAVRDUDE_PATH=${avrdude}/bin/avrdude"
+
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/discord/openasar.nix b/pkgs/applications/networking/instant-messengers/discord/openasar.nix
index ba4b5f0ffd4e9..664fe622ac3bc 100644
--- a/pkgs/applications/networking/instant-messengers/discord/openasar.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/openasar.nix
@@ -1,15 +1,5 @@
 { lib, stdenv, fetchFromGitHub, nodejs, bash, nodePackages, unzip }:
 
-let
-  # OpenAsar fails with default unzip, throwing  "lchmod (file attributes) error: Operation not supported"
-  unzipFix =
-    if stdenv.isLinux then
-      unzip.overrideAttrs (oldAttrs: {
-        buildFlags = oldAttrs.buildFlags ++ [ "LOCAL_UNZIP=-DNO_LCHMOD" ];
-      })
-    else
-      unzip;
-in
 stdenv.mkDerivation rec {
   pname = "openasar";
   version = "unstable-2022-06-27";
@@ -24,7 +14,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # Hardcode unzip path
     substituteInPlace ./src/updater/moduleUpdater.js \
-      --replace \'unzip\' \'${unzipFix}/bin/unzip\'
+      --replace \'unzip\' \'${unzip}/bin/unzip\'
     # Remove auto-update feature
     echo "module.exports = async () => log('AsarUpdate', 'Removed');" > ./src/asarUpdate.js
   '';
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index 306a53f0a3c0e..71299566dd871 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -83,6 +83,9 @@ mkDerivation rec {
   cmakeFlags = [
     "-DMINIZIP_INCLUDE_DIRS=${minizip2}/include"
     "-DMINIZIP_LIBRARIES=minizip"
+
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
   # The default install phase fails because the paths are somehow messed up in
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index b74905586192d..2f41d0ec55ff8 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -59,10 +59,6 @@ in stdenv.mkDerivation {
     sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
   '';
 
-  preBuild = ''
-    export LD_LIBRARY_PATH="$PWD/run"
-  '';
-
   postInstall = ''
     # to remove "cycle detected in the references"
     mkdir -p $dev/lib/wireshark
diff --git a/pkgs/applications/office/PageEdit/default.nix b/pkgs/applications/office/PageEdit/default.nix
index e003c3a0e516c..02a69a0fe15c0 100644
--- a/pkgs/applications/office/PageEdit/default.nix
+++ b/pkgs/applications/office/PageEdit/default.nix
@@ -13,7 +13,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ cmake qttranslations ];
   propagatedBuildInputs = [ qtsvg qtwebengine ];
-  cmakeFlags = "-DINSTALL_BUNDLED_DICTS=0";
+  cmakeFlags = [ "-DINSTALL_BUNDLED_DICTS=0" ];
 
   meta = with lib; {
     description = "ePub XHTML Visual Editor";
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 1c6fe68480d72..e33ef517088ae 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -154,8 +154,6 @@ stdenv.mkDerivation rec {
       test-xml-pricedb \
       test-xml-transaction \
       test-xml2-is-file
-
-      export LD_LIBRARY_PATH="$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test:$PWD/lib/gnucash/test/future"
   '';
 
   preFixup = ''
diff --git a/pkgs/applications/radio/dsd/default.nix b/pkgs/applications/radio/dsd/default.nix
index e885270370eca..c98974740667d 100644
--- a/pkgs/applications/radio/dsd/default.nix
+++ b/pkgs/applications/radio/dsd/default.nix
@@ -22,10 +22,6 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals portaudioSupport [ portaudio ];
 
   doCheck = true;
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD
-  '';
 
   meta = with lib; {
     description = "Digital Speech Decoder";
diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index 0fbd824008a56..aa5d9a7ade198 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -75,7 +75,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = optionals (debug) [ "CFLAGS+=-Og" "CFLAGS+=-ggdb" ];
 
-  cmakeFlags = optionals (withScripting) [
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ]
+  ++ optionals (withScripting) [
     "-DKICAD_SCRIPTING_WXPYTHON=ON"
   ]
   ++ optionals (!withScripting) [
diff --git a/pkgs/applications/science/logic/btor2tools/default.nix b/pkgs/applications/science/logic/btor2tools/default.nix
index 992d8b1de58f4..0cb9c8037cb20 100644
--- a/pkgs/applications/science/logic/btor2tools/default.nix
+++ b/pkgs/applications/science/logic/btor2tools/default.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "lib" ];
 
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/btorsim contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   meta = with lib; {
     description = "A generic parser and tool package for the BTOR2 format";
     homepage    = "https://github.com/Boolector/btor2tools";
diff --git a/pkgs/applications/science/logic/monosat/default.nix b/pkgs/applications/science/logic/monosat/default.nix
index e49c80db9d6e6..2709b16c5770c 100644
--- a/pkgs/applications/science/logic/monosat/default.nix
+++ b/pkgs/applications/science/logic/monosat/default.nix
@@ -47,6 +47,9 @@ let
       "-DBUILD_STATIC=OFF"
       "-DJAVA=${boolToCmake includeJava}"
       "-DGPL=${boolToCmake includeGplCode}"
+
+      # file RPATH_CHANGE could not write new RPATH
+      "-DCMAKE_SKIP_BUILD_RPATH=ON"
     ];
 
     postInstall = optionalString includeJava ''
diff --git a/pkgs/applications/science/machine-learning/shogun/default.nix b/pkgs/applications/science/machine-learning/shogun/default.nix
index b715c2fc33b34..c7209d00af515 100644
--- a/pkgs/applications/science/machine-learning/shogun/default.nix
+++ b/pkgs/applications/science/machine-learning/shogun/default.nix
@@ -134,7 +134,6 @@ stdenv.mkDerivation rec {
     "-DCMAKE_DISABLE_FIND_PACKAGE_Mosek=ON"
     "-DCMAKE_DISABLE_FIND_PACKAGE_TFLogger=ON"
     "-DCMAKE_DISABLE_FIND_PACKAGE_ViennaCL=ON"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DCMAKE_CTEST_ARGUMENTS='--exclude-regex;TrainedModelSerialization'"  # Sporadic segfault
     "-DENABLE_TESTING=${enableIf doCheck}"
     "-DDISABLE_META_INTEGRATION_TESTS=ON"
diff --git a/pkgs/applications/science/misc/simgrid/default.nix b/pkgs/applications/science/misc/simgrid/default.nix
index 4867e6c9ed552..8db9245ed33ed 100644
--- a/pkgs/applications/science/misc/simgrid/default.nix
+++ b/pkgs/applications/science/misc/simgrid/default.nix
@@ -65,6 +65,9 @@ stdenv.mkDerivation rec {
     "-Denable_compile_warnings=off"
     "-Denable_compile_optimizations=${optionOnOff optimize}"
     "-Denable_lto=${optionOnOff optimize}"
+
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
   makeFlags = optional debug "VERBOSE=1";
 
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 6e33c013dc92f..afd960f0364fc 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -26,7 +26,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.36.1";
+  version = "2.37.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0w43a35mhc2qf2gjkxjlnkf2lq8g0snf34iy5gqx2678yq7llpa0";
+    sha256 = "sha256-n3+hcRvQDE7D3eL+REB9wT8S5HcrXjxypY20wHSVQR8=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/applications/video/avidemux/default.nix b/pkgs/applications/video/avidemux/default.nix
index d6b0467fb7295..35c628f8a59d8 100644
--- a/pkgs/applications/video/avidemux/default.nix
+++ b/pkgs/applications/video/avidemux/default.nix
@@ -66,7 +66,6 @@ stdenv.mkDerivation rec {
     cd "$sourceRoot"
     patchPhase
 
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${libXext}/lib"
     ${stdenv.shell} bootStrap.bash \
       --with-core \
       ${if withQT then "--with-qt" else "--without-qt"} \
diff --git a/pkgs/applications/video/ccextractor/default.nix b/pkgs/applications/video/ccextractor/default.nix
index 905034091a297..26954375aff5b 100644
--- a/pkgs/applications/video/ccextractor/default.nix
+++ b/pkgs/applications/video/ccextractor/default.nix
@@ -36,7 +36,10 @@ stdenv.mkDerivation rec {
     ++ lib.optional (!stdenv.isLinux) libiconv
     ++ lib.optionals enableOcr [ leptonica tesseract4 ffmpeg ];
 
-  cmakeFlags = lib.optionals enableOcr [ "-DWITH_OCR=on" "-DWITH_HARDSUBX=on" ];
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH:
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ] ++ lib.optionals enableOcr [ "-DWITH_OCR=on" "-DWITH_HARDSUBX=on" ];
 
   postInstall = lib.optionalString enableOcr ''
     wrapProgram "$out/bin/ccextractor" \
diff --git a/pkgs/applications/video/rtabmap/default.nix b/pkgs/applications/video/rtabmap/default.nix
index c6429b093486a..3dce0123d1be3 100644
--- a/pkgs/applications/video/rtabmap/default.nix
+++ b/pkgs/applications/video/rtabmap/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Disable warnings that are irrelevant to us as packagers
-  cmakeFlags = "-Wno-dev";
+  cmakeFlags = [ "-Wno-dev" ];
 
   # We run one of the executables we build while the build is
   # still running (and patchelf hasn't been invoked) which means
diff --git a/pkgs/data/icons/arc-icon-theme/default.nix b/pkgs/data/icons/arc-icon-theme/default.nix
index 88184b585ecf8..2950f929912a6 100644
--- a/pkgs/data/icons/arc-icon-theme/default.nix
+++ b/pkgs/data/icons/arc-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, gtk3, gnome, moka-icon-theme, gnome-icon-theme, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub, autoreconfHook, gtk3, gnome, moka-icon-theme, gnome-icon-theme, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "arc-icon-theme";
   version = "2016-11-22";
 
diff --git a/pkgs/data/icons/beauty-line-icon-theme/default.nix b/pkgs/data/icons/beauty-line-icon-theme/default.nix
index 2942315f7da1c..3ed92f1965d90 100644
--- a/pkgs/data/icons/beauty-line-icon-theme/default.nix
+++ b/pkgs/data/icons/beauty-line-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchzip, breeze-icons, gtk3, gnome-icon-theme, hicolor-icon-theme, mint-x-icons, pantheon }:
+{ lib, stdenvNoCC, fetchzip, breeze-icons, gtk3, gnome-icon-theme, hicolor-icon-theme, mint-x-icons, pantheon }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "BeautyLine";
   version = "0.0.1";
 
diff --git a/pkgs/data/icons/bibata-cursors/default.nix b/pkgs/data/icons/bibata-cursors/default.nix
index 15905bec3a97f..b27b96cb5efb5 100644
--- a/pkgs/data/icons/bibata-cursors/default.nix
+++ b/pkgs/data/icons/bibata-cursors/default.nix
@@ -1,12 +1,12 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchFromGitHub
 , fetchurl
 , clickgen
 , unzip
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "bibata-cursors";
   version = "1.1.2";
 
diff --git a/pkgs/data/icons/bibata-cursors/extra.nix b/pkgs/data/icons/bibata-cursors/extra.nix
index a6fdaca842770..15a746eabffb7 100644
--- a/pkgs/data/icons/bibata-cursors/extra.nix
+++ b/pkgs/data/icons/bibata-cursors/extra.nix
@@ -1,12 +1,12 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchFromGitHub
 , fetchurl
 , clickgen
 , unzip
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "bibata-extra-cursors";
   version = "1.0.1";
 
diff --git a/pkgs/data/icons/bibata-cursors/translucent.nix b/pkgs/data/icons/bibata-cursors/translucent.nix
index 74d7c4d7c3f91..efaf25c59f2bf 100644
--- a/pkgs/data/icons/bibata-cursors/translucent.nix
+++ b/pkgs/data/icons/bibata-cursors/translucent.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "bibata-cursors-translucent";
   version = "1.1.1";
 
diff --git a/pkgs/data/icons/capitaine-cursors/default.nix b/pkgs/data/icons/capitaine-cursors/default.nix
index 075dbc922bd48..47fbeda109425 100644
--- a/pkgs/data/icons/capitaine-cursors/default.nix
+++ b/pkgs/data/icons/capitaine-cursors/default.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, makeFontsConf
+{ lib, stdenvNoCC, fetchFromGitHub, fetchpatch, makeFontsConf
 , inkscape, xcursorgen, bc }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "capitaine-cursors";
   version = "4";
 
diff --git a/pkgs/data/icons/comixcursors/default.nix b/pkgs/data/icons/comixcursors/default.nix
index 2b52b703353e5..b63877b282098 100644
--- a/pkgs/data/icons/comixcursors/default.nix
+++ b/pkgs/data/icons/comixcursors/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, bc, librsvg, xcursorgen }:
+{ lib, stdenvNoCC, fetchFromGitLab, bc, librsvg, xcursorgen }:
 
 let
   dimensions = {
@@ -16,7 +16,7 @@ let
     # meta.longDescription.)
     map variantName product;
 in
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "comixcursors";
   version = "0.9.2";
 
diff --git a/pkgs/data/icons/faba-icon-theme/default.nix b/pkgs/data/icons/faba-icon-theme/default.nix
index 1119e248522a0..921c87774c31d 100644
--- a/pkgs/data/icons/faba-icon-theme/default.nix
+++ b/pkgs/data/icons/faba-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, python3, gtk3, pantheon, gnome-icon-theme, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub, meson, ninja, python3, gtk3, pantheon, gnome-icon-theme, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "faba-icon-theme";
   version = "4.3";
 
diff --git a/pkgs/data/icons/faba-mono-icons/default.nix b/pkgs/data/icons/faba-mono-icons/default.nix
index 0627c87bfc5ee..47eeab40acb78 100644
--- a/pkgs/data/icons/faba-mono-icons/default.nix
+++ b/pkgs/data/icons/faba-mono-icons/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, gtk3, moka-icon-theme, faba-icon-theme, gnome-icon-theme, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub, autoreconfHook, gtk3, moka-icon-theme, faba-icon-theme, gnome-icon-theme, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "faba-mono-icons";
   version = "2016-04-30";
 
diff --git a/pkgs/data/icons/gruvbox-dark-icons-gtk/default.nix b/pkgs/data/icons/gruvbox-dark-icons-gtk/default.nix
index 7b779191b6b21..972b5dfba5625 100644
--- a/pkgs/data/icons/gruvbox-dark-icons-gtk/default.nix
+++ b/pkgs/data/icons/gruvbox-dark-icons-gtk/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, breeze-icons, gnome-icon-theme, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub, gtk3, breeze-icons, gnome-icon-theme, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "gruvbox-dark-icons-gtk";
   version = "1.0.0";
 
diff --git a/pkgs/data/icons/hicolor-icon-theme/default.nix b/pkgs/data/icons/hicolor-icon-theme/default.nix
index 4a58b8fb89ad7..4fb1ada66540c 100644
--- a/pkgs/data/icons/hicolor-icon-theme/default.nix
+++ b/pkgs/data/icons/hicolor-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenvNoCC, fetchurl }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "hicolor-icon-theme";
   version = "0.17";
 
diff --git a/pkgs/data/icons/iconpack-jade/default.nix b/pkgs/data/icons/iconpack-jade/default.nix
index 3a5fe541985ae..d68e02b838d6a 100644
--- a/pkgs/data/icons/iconpack-jade/default.nix
+++ b/pkgs/data/icons/iconpack-jade/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "iconpack-jade";
   version = "1.25";
 
diff --git a/pkgs/data/icons/iconpack-obsidian/default.nix b/pkgs/data/icons/iconpack-obsidian/default.nix
index 13b314e1ae059..40d4d451f3f1d 100644
--- a/pkgs/data/icons/iconpack-obsidian/default.nix
+++ b/pkgs/data/icons/iconpack-obsidian/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, gnome-icon-theme, mint-x-icons, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub, gtk3, gnome-icon-theme, mint-x-icons, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "iconpack-obsidian";
   version = "4.15";
 
diff --git a/pkgs/data/icons/iso-flags/default.nix b/pkgs/data/icons/iso-flags/default.nix
index 57cc1752f1873..9deff6bcc77ec 100644
--- a/pkgs/data/icons/iso-flags/default.nix
+++ b/pkgs/data/icons/iso-flags/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv
+{ lib, stdenvNoCC
 , fetchFromGitHub
 , perl
 , inkscape
@@ -6,7 +6,7 @@
 , targets ? [ "all" ]
 }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = "iso-flags";
   version = "unstable-18012020";
 
diff --git a/pkgs/data/icons/kora-icon-theme/default.nix b/pkgs/data/icons/kora-icon-theme/default.nix
index 4de65c8386260..ea321a7635910 100644
--- a/pkgs/data/icons/kora-icon-theme/default.nix
+++ b/pkgs/data/icons/kora-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub , gtk3, adwaita-icon-theme, breeze-icons, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub , gtk3, adwaita-icon-theme, breeze-icons, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec  {
+stdenvNoCC.mkDerivation rec  {
   pname = "kora-icon-theme";
   version = "1.5.2";
 
diff --git a/pkgs/data/icons/la-capitaine-icon-theme/default.nix b/pkgs/data/icons/la-capitaine-icon-theme/default.nix
index b7febabacd5f4..01e2a3ea47812 100644
--- a/pkgs/data/icons/la-capitaine-icon-theme/default.nix
+++ b/pkgs/data/icons/la-capitaine-icon-theme/default.nix
@@ -1,5 +1,5 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchFromGitHub
 , breeze-icons
 , elementary-icon-theme
@@ -7,7 +7,7 @@
 , hicolor-icon-theme
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "la-capitaine-icon-theme";
   version = "0.6.2";
 
diff --git a/pkgs/data/icons/moka-icon-theme/default.nix b/pkgs/data/icons/moka-icon-theme/default.nix
index 04e1bce127509..d9fef47da0bb1 100644
--- a/pkgs/data/icons/moka-icon-theme/default.nix
+++ b/pkgs/data/icons/moka-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, gtk3, python3, faba-icon-theme, hicolor-icon-theme, jdupes }:
+{ lib, stdenvNoCC, fetchFromGitHub, meson, ninja, gtk3, python3, faba-icon-theme, hicolor-icon-theme, jdupes }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "moka-icon-theme";
   version = "unstable-2019-05-29";
 
diff --git a/pkgs/data/icons/nordzy-cursor-theme/default.nix b/pkgs/data/icons/nordzy-cursor-theme/default.nix
index 7648a57474ae2..ee18fe2877270 100644
--- a/pkgs/data/icons/nordzy-cursor-theme/default.nix
+++ b/pkgs/data/icons/nordzy-cursor-theme/default.nix
@@ -1,9 +1,9 @@
-{ stdenv
+{ stdenvNoCC
 , fetchFromGitHub
 , lib
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "nordzy-cursor-theme";
   version = "0.1.0";
 
diff --git a/pkgs/data/icons/numix-cursor-theme/default.nix b/pkgs/data/icons/numix-cursor-theme/default.nix
index e7f0905ff40eb..83961f19caf83 100644
--- a/pkgs/data/icons/numix-cursor-theme/default.nix
+++ b/pkgs/data/icons/numix-cursor-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, inkscape, xcursorgen }:
+{ lib, stdenvNoCC, fetchFromGitHub, inkscape, xcursorgen }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "numix-cursor-theme";
   version = "1.2";
 
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index 235895d8b0393..5da3838596c08 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, numix-icon-theme, hicolor-icon-theme, gitUpdater }:
+{ lib, stdenvNoCC, fetchFromGitHub, gtk3, numix-icon-theme, hicolor-icon-theme, gitUpdater }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
   version = "22.07.11";
 
diff --git a/pkgs/data/icons/numix-icon-theme-square/default.nix b/pkgs/data/icons/numix-icon-theme-square/default.nix
index 1f37dfe1f226f..6cb002e7d5013 100644
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, numix-icon-theme, hicolor-icon-theme, gitUpdater }:
+{ lib, stdenvNoCC, fetchFromGitHub, gtk3, numix-icon-theme, hicolor-icon-theme, gitUpdater }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-square";
   version = "22.07.11";
 
diff --git a/pkgs/data/icons/numix-icon-theme/default.nix b/pkgs/data/icons/numix-icon-theme/default.nix
index c46cc0a6ec9a0..576fa405e06fe 100644
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme";
   version = "21.10.31";
 
diff --git a/pkgs/data/icons/oranchelo-icon-theme/default.nix b/pkgs/data/icons/oranchelo-icon-theme/default.nix
index 9288b9307f558..5c93acbb10af9 100644
--- a/pkgs/data/icons/oranchelo-icon-theme/default.nix
+++ b/pkgs/data/icons/oranchelo-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, plasma5Packages, hicolor-icon-theme }:
+{ lib, stdenvNoCC, fetchFromGitHub, gtk3, plasma5Packages, hicolor-icon-theme }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "oranchelo-icon-theme";
   version = "0.8.0.1";
 
diff --git a/pkgs/data/icons/paper-icon-theme/default.nix b/pkgs/data/icons/paper-icon-theme/default.nix
index fc541f6e5b722..ae5a43eca0b35 100644
--- a/pkgs/data/icons/paper-icon-theme/default.nix
+++ b/pkgs/data/icons/paper-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, gtk3, gnome, gnome-icon-theme, hicolor-icon-theme, jdupes }:
+{ lib, stdenvNoCC, fetchFromGitHub, meson, ninja, gtk3, gnome, gnome-icon-theme, hicolor-icon-theme, jdupes }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "paper-icon-theme";
   version = "unstable-2020-03-12";
 
diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/data/icons/papirus-icon-theme/default.nix
index 56ac57e4a5c04..4980f36312c1e 100644
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, gtk3, pantheon, breeze-icons, gnome-icon-theme, hicolor-icon-theme, papirus-folders, color ? null }:
+{ lib, stdenvNoCC, fetchFromGitHub, fetchurl, gtk3, pantheon, breeze-icons, gnome-icon-theme, hicolor-icon-theme, papirus-folders, color ? null }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "papirus-icon-theme";
   version = "20220710";
 
diff --git a/pkgs/data/icons/pop-icon-theme/default.nix b/pkgs/data/icons/pop-icon-theme/default.nix
index 7254e8bc21399..ddf3d1afe6d5f 100644
--- a/pkgs/data/icons/pop-icon-theme/default.nix
+++ b/pkgs/data/icons/pop-icon-theme/default.nix
@@ -1,5 +1,5 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchFromGitHub
 , meson
 , ninja
@@ -8,7 +8,7 @@
 , hicolor-icon-theme
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "pop-icon-theme";
   version = "2021-11-17";
 
diff --git a/pkgs/data/icons/vanilla-dmz/default.nix b/pkgs/data/icons/vanilla-dmz/default.nix
index 55ba320bc9885..0d3f273d5bb22 100644
--- a/pkgs/data/icons/vanilla-dmz/default.nix
+++ b/pkgs/data/icons/vanilla-dmz/default.nix
@@ -1,11 +1,11 @@
-{ stdenv
+{ stdenvNoCC
 , lib
 , fetchzip
 , xorg
 , hicolor-icon-theme
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "vanilla-dmz";
   version = "0.4.5";
 
diff --git a/pkgs/data/icons/vimix-icon-theme/default.nix b/pkgs/data/icons/vimix-icon-theme/default.nix
index 853b1d209abbf..7ef0abb85c227 100644
--- a/pkgs/data/icons/vimix-icon-theme/default.nix
+++ b/pkgs/data/icons/vimix-icon-theme/default.nix
@@ -1,5 +1,5 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchFromGitHub
 , gtk3
 , hicolor-icon-theme
@@ -13,7 +13,7 @@ let
 in
 lib.checkListOfEnum "${pname}: color variants" [ "standard" "Amethyst" "Beryl" "Doder" "Ruby" "Black" "White" ] colorVariants
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   inherit pname;
   version = "2021-11-09";
 
diff --git a/pkgs/data/misc/shared-mime-info/default.nix b/pkgs/data/misc/shared-mime-info/default.nix
index a2d2849bac1e5..197793db6c66f 100644
--- a/pkgs/data/misc/shared-mime-info/default.nix
+++ b/pkgs/data/misc/shared-mime-info/default.nix
@@ -13,17 +13,17 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "shared-mime-info-unstable";
-  version = "2021-12-03";
+  pname = "shared-mime-info";
+  version = "2.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "xdg";
-    repo = "shared-mime-info";
-    rev = "5a406b06792e26a83c7346b3c2443c0bd8d4cdb2";
-    sha256 = "1v7dx7mr0m4lcff1aasg9gxn280zn0ffn6fjg9xc44pnllg01n6s";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-QrRe/DcjpTMejHXDSOLbjpJywod8qIjP6/leTZ21rhE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index 0a8d46157a6e9..c4a12cd5ca867 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -119,7 +119,6 @@ stdenv.mkDerivation rec {
     "-DENABLE_UOA=OFF"
     "-DENABLE_VALA_BINDINGS=ON"
     "-DENABLE_INTROSPECTION=ON"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DINCLUDE_INSTALL_DIR=${placeholder "dev"}/include"
     "-DWITH_PHONENUMBER=ON"
     "-DWITH_GWEATHER4=ON"
diff --git a/pkgs/desktops/plasma-5/kwin/default.nix b/pkgs/desktops/plasma-5/kwin/default.nix
index 847ef41ee88b7..74c6b1b7faa5e 100644
--- a/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/pkgs/desktops/plasma-5/kwin/default.nix
@@ -61,7 +61,6 @@ mkDerivation {
   CXXFLAGS = [
     ''-DNIXPKGS_XWAYLAND=\"${lib.getBin xwayland}/bin/Xwayland\"''
   ];
-  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=OFF" ];
   postInstall = ''
     # Some package(s) refer to these service types by the wrong name.
     # I would prefer to patch those packages, but I cannot find them!
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index bebf91114d702..910d93d42da13 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -222,9 +222,6 @@ let
     ++ lib.optionals (langD) [
       "--with-target-system-zlib=yes"
     ]
-    # Make -fcommon default on gcc10
-    # TODO: fix all packages (probably 100+) and remove that
-    ++ lib.optional (version >= "10.1.0") "--with-specs=%{!fno-common:%{!fcommon:-fcommon}}"
   ;
 
 in configureFlags
diff --git a/pkgs/development/compilers/halide/default.nix b/pkgs/development/compilers/halide/default.nix
index 916d8fa56f75d..853cf1a663e95 100644
--- a/pkgs/development/compilers/halide/default.nix
+++ b/pkgs/development/compilers/halide/default.nix
@@ -32,12 +32,6 @@ llvmPackages.stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DWARNINGS_AS_ERRORS=OFF" "-DWITH_PYTHON_BINDINGS=OFF" ];
 
-  # To handle the lack of 'local' RPATH; required, as they call one of
-  # their built binaries requiring their libs, in the build process.
-  preBuild = ''
-    export LD_LIBRARY_PATH="$(pwd)/src''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-  '';
-
   # Note: only openblas and not atlas part of this Nix expression
   # see pkgs/development/libraries/science/math/liblapack/3.5.0.nix
   # to get a hint howto setup atlas instead of openblas
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 128ac5709356d..bb1b90b36a922 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -244,12 +244,6 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 58439f02a5c92..4bcdb3ca78b42 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -50,18 +50,6 @@ let
       ./purity.patch
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
-      # Revert: [Driver] Default to -fno-common for all targets
-      # https://reviews.llvm.org/D75056
-      #
-      # Maintains compatibility with packages that haven't been fixed yet, and
-      # matches gcc10's configuration in nixpkgs.
-      (fetchpatch {
-        revert = true;
-        url = "https://github.com/llvm/llvm-project/commit/0a9fc9233e172601e26381810d093e02ef410f65.diff";
-        stripLen = 1;
-        excludes = [ "docs/*" "test/*" ];
-        sha256 = "0gxgmi0qbm89mq911dahallhi8m6wa9vpklklqmxafx4rplrr8ph";
-      })
       (substituteAll {
         src = ../../clang-11-12-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index f7a5044834599..a038795a4df10 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -256,12 +256,6 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 56a3d01e4b16d..435744b073f7f 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -244,12 +244,6 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index b1dce12faccbe..6372655b7ed4f 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -206,12 +206,6 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index b18b558d5b8e6..3a1ba402ef671 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -18,7 +18,7 @@
 }:
 
 let
-  release_version = "14.0.1";
+  release_version = "14.0.6";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   rev = ""; # When using a Git commit
@@ -30,7 +30,7 @@ let
     owner = "llvm";
     repo = "llvm-project";
     rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "14wgrjwj02ivlwb1zgidacspkkcfpsqjmgd7r838qmwpk56yxl9f";
+    sha256 = "sha256-vffu4HilvYwtzwgq+NlS26m65DGbp6OSSne2aje1yJE=";
   };
 
   llvm_meta = {
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index c3f3c94f434cf..d053f792f7d99 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -203,12 +203,6 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index 253aaade6939e..cf668cd566a65 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -222,12 +222,6 @@ stdenv.mkDerivation (rec {
       ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${v}.dylib
     '') versionSuffixes}
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 622b90e58e874..61f9234274d35 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -215,12 +215,6 @@ stdenv.mkDerivation (rec {
       ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${v}.dylib
     '') versionSuffixes}
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index 01784baca8ce6..b324e1a0e4d61 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -234,12 +234,6 @@ in stdenv.mkDerivation (rec {
       ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${v}.dylib
     '') versionSuffixes}
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 01a052d4042fc..efd1707eb3378 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -226,12 +226,6 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index b197e9ab8ba18..1dd1455ed6d69 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -241,12 +241,6 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 02ec0f3ab119a..d2059cc66ba23 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -200,12 +200,6 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
-  + optionalString enableSharedLibraries ''
-    mkdir -p $dev/lib
-    mv $lib/lib/*.a $dev/lib
-    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
-      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
-  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
diff --git a/pkgs/development/compilers/rust/1_61.nix b/pkgs/development/compilers/rust/1_62.nix
similarity index 56%
rename from pkgs/development/compilers/rust/1_61.nix
rename to pkgs/development/compilers/rust/1_62.nix
index 7726c2db10ea2..779d24c4959c4 100644
--- a/pkgs/development/compilers/rust/1_61.nix
+++ b/pkgs/development/compilers/rust/1_62.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.61.0";
-  rustcSha256 = "1vfs05hkf9ilk19b2vahqn8l6k17pl9nc1ky9kgspaascx8l62xd";
+  rustcVersion = "1.62.0";
+  rustcSha256 = "09y06qmh7ihi9kgimpp3h4nj3cmgc1zypqyaba10dlk4kf07h23x";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
@@ -37,25 +37,25 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.60.0";
+  bootstrapVersion = "1.61.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "2a635269dc9ad8f7bbdf168cdf120e1ec803d36adc832c0804f38e0acc3e2357";
-    x86_64-unknown-linux-gnu = "b8a4c3959367d053825e31f90a5eb86418eb0d80cacda52bfa80b078e18150d5";
-    x86_64-unknown-linux-musl = "f0feefcb1985c5c894ad9b0f44e6f09900b31c0eb5f49827da9f37d332a63894";
-    arm-unknown-linux-gnueabihf = "161b2b97d4512080350cc6656b0765ebae870335e86c2896bed08b32c66fbdf4";
-    armv7-unknown-linux-gnueabihf = "f2d76e9458949675bab8fcae44f600d30d91f62bf93c127b6b1fe3130e67d5d9";
-    aarch64-unknown-linux-gnu = "99c419c2f35d4324446481c39402c7baecd7a8baed7edca9f8d6bbd33c05550c";
-    aarch64-unknown-linux-musl = "fe7e9bad8beea84973f7ffa39879929de4ac8afad872650fb0af6b068f05faa6";
-    x86_64-apple-darwin = "0b10dc45cddc4d2355e38cac86d71a504327cb41d41d702d4050b9847ad4258c";
-    aarch64-apple-darwin = "b532672c278c25683ca63d78e82bae829eea1a32308e844954fb66cfe34ad222";
-    powerpc64le-unknown-linux-gnu = "80125e90285b214c2b1f56ab86a09c8509aa17aec9d7127960a86a7008e8f7de";
-    riscv64gc-unknown-linux-gnu = "9cc7c6804bcbbecb9c35232035fc488dbcc8487606cc6be3da553cc446bf0fcd";
-    mips64el-unknown-linux-gnuabi64 = "d413681c22511259f7cd15414a00050cf151d46ac0f9282e765faeb86688deac";
+    i686-unknown-linux-gnu = "b15eb0ad44b7253e0b5b1a8cd285feb10e9fb0402840dba9a13112c3349a4b39";
+    x86_64-unknown-linux-gnu = "066b324239d30787ce64142d7e04912f2e1850c07db3b2354d8654e02ff8b23a";
+    x86_64-unknown-linux-musl = "0904f6b769ae28c259e0e25a41e99290a4ae2a36bca63ae153790b2ebbc427bf";
+    arm-unknown-linux-gnueabihf = "cc32705cd1b583aaac74e6663f71392131dc0355a0f484cb56f0378b71ea7ebc";
+    armv7-unknown-linux-gnueabihf = "2782ec75ea4abb402513e2e57becc6c14e67b492d57228cddedef6db0853b165";
+    aarch64-unknown-linux-gnu = "261cd47bc3c98c9f97b601d1ad2a7d9b33c9ea63c9a351119c2f6d4e82f5d436";
+    aarch64-unknown-linux-musl = "feb79985cb161a10b252236852df8db3bf3593c78905b84c7e94cd4454327e47";
+    x86_64-apple-darwin = "d851f1a473926a5d8f111ed08002047a5dc4ad944a5b7f8d5d2f1f266b51e66a";
+    aarch64-apple-darwin = "2dbafd13d007543aada47179fa273f9a3865f27e0a07bd69be61801232a0819e";
+    powerpc64le-unknown-linux-gnu = "6d5cd579b68a2adc20384406c69a92beaaf4941056e126ff0ed1ec2f3a4e721f";
+    riscv64gc-unknown-linux-gnu = "3d0f3b1a8522e09fffdf920a061794ac3107410eb1fe8f5d62a7aae3c6dcb81e";
+    mips64el-unknown-linux-gnuabi64 = "6ed5b6492e68f45488108abd06dbcd4b89c46cdbd4715331bb11e88f18500815";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_61;
+  selectRustPackage = pkgs: pkgs.rust_1_62;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/seexpr/default.nix b/pkgs/development/compilers/seexpr/default.nix
index f13ec5174d5ae..b07a91599332f 100644
--- a/pkgs/development/compilers/seexpr/default.nix
+++ b/pkgs/development/compilers/seexpr/default.nix
@@ -22,7 +22,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-r6mgyb/FGz4KYZOgLDgmIqjO+PSmneD3KUWjymZXtEk=";
   };
 
-  cmakeFlags = [ "-DENABLE_SSE4=OFF" ];
+  cmakeFlags = [
+    "-DENABLE_SSE4=OFF"
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libGLU libpng zlib qt4 python3Packages.pyqt4 python3Packages.boost bison flex ];
diff --git a/pkgs/development/compilers/solc/default.nix b/pkgs/development/compilers/solc/default.nix
index 6594872a258f7..d00a354be187b 100644
--- a/pkgs/development/compilers/solc/default.nix
+++ b/pkgs/development/compilers/solc/default.nix
@@ -90,12 +90,6 @@ let
     doCheck = false;
 
     checkPhase = ''
-      while IFS= read -r -d ''' dir
-      do
-        LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/$dir
-        export LD_LIBRARY_PATH
-      done <   <(find . -type d -print0)
-
       pushd ..
       # IPC tests need aleth avaliable, so we disable it
       sed -i "s/IPC_ENABLED=true/IPC_ENABLED=false\nIPC_FLAGS=\"--no-ipc\"/" ./scripts/tests.sh
diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index b0ba8508fc359..ace6c773770a6 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
     "-DLLVM_DIR=${llvm_11.dev}"
     "-DBUILD_SHARED_LIBS=YES"
     "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
+    # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
   # FIXME: CMake tries to run "/llvm-lit" which of course doesn't exist
diff --git a/pkgs/development/compilers/zig/default.nix b/pkgs/development/compilers/zig/default.nix
index d64c002bf7dfb..62187827423d8 100644
--- a/pkgs/development/compilers/zig/default.nix
+++ b/pkgs/development/compilers/zig/default.nix
@@ -36,6 +36,11 @@ stdenv.mkDerivation rec {
     export HOME=$TMPDIR;
   '';
 
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   doCheck = true;
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/embedded/xc3sprog/default.nix b/pkgs/development/embedded/xc3sprog/default.nix
index b9785bac7c5c4..ead48a004720c 100644
--- a/pkgs/development/embedded/xc3sprog/default.nix
+++ b/pkgs/development/embedded/xc3sprog/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libusb-compat-0_1 libftdi ];
 
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   meta = with lib; {
     description = "Command-line tools for programming FPGAs, microcontrollers and PROMs via JTAG";
     homepage = "http://xc3sprog.sourceforge.net/";
diff --git a/pkgs/development/libraries/a52dec/default.nix b/pkgs/development/libraries/a52dec/default.nix
index 921e90e3025a9..fdb309c634dad 100644
--- a/pkgs/development/libraries/a52dec/default.nix
+++ b/pkgs/development/libraries/a52dec/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl}:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "a52dec";
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-shared"
+    # Define inline as __attribute__ ((__always_inline__))
+    "ac_cv_c_inline=yes"
   ];
 
   makeFlags = [
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index a69d161c9268f..c88afbe6a0fcf 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -204,7 +204,6 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (!enableShared) [
     "-DARROW_TEST_LINKAGE=static"
   ] ++ lib.optionals stdenv.isDarwin [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # needed for tests
     "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
   ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF"
   ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp}/include/aws/core/Aws.h";
diff --git a/pkgs/development/libraries/audio/libkeyfinder/default.nix b/pkgs/development/libraries/audio/libkeyfinder/default.nix
index cb34f24ced8d8..65e4d0fb15eeb 100644
--- a/pkgs/development/libraries/audio/libkeyfinder/default.nix
+++ b/pkgs/development/libraries/audio/libkeyfinder/default.nix
@@ -11,9 +11,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-7w/Wc9ncLinbnM2q3yv5DBtFoJFAM2e9xAUTsqvE9mg=";
   };
 
-  # needed for finding libkeyfinder.so to link it into keyfinder-tests executable
-  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=OFF" ];
-
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [ fftw ];
diff --git a/pkgs/development/libraries/audio/mbelib/default.nix b/pkgs/development/libraries/audio/mbelib/default.nix
index dc01027c46932..dccb738a30f4f 100644
--- a/pkgs/development/libraries/audio/mbelib/default.nix
+++ b/pkgs/development/libraries/audio/mbelib/default.nix
@@ -14,10 +14,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   doCheck = true;
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD
-  '';
 
   meta = with lib; {
     description = "P25 Phase 1 and ProVoice vocoder";
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 5b8590750178d..2c70c3e8acba5 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -39,7 +39,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 1b8f7e73e822b..b20371f5dd29a 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -20,7 +20,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # for tests
   ] ++ lib.optionals stdenv.hostPlatform.isRiscV [
     "-DCMAKE_C_FLAGS=-fasynchronous-unwind-tables"
   ];
diff --git a/pkgs/development/libraries/aws-c-compression/default.nix b/pkgs/development/libraries/aws-c-compression/default.nix
index 9d885278ff06c..5d13c0653b223 100644
--- a/pkgs/development/libraries/aws-c-compression/default.nix
+++ b/pkgs/development/libraries/aws-c-compression/default.nix
@@ -24,7 +24,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/aws-c-http/default.nix b/pkgs/development/libraries/aws-c-http/default.nix
index 0eee407f989a4..86ab4f4230e69 100644
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@@ -32,7 +32,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/aws-c-mqtt/default.nix b/pkgs/development/libraries/aws-c-mqtt/default.nix
index 11ba67fe6f5a5..6700b4e6a13e1 100644
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index 398a36019f544..881bec9c2805c 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/aws-c-sdkutils/default.nix b/pkgs/development/libraries/aws-c-sdkutils/default.nix
index 6fb04fbb3a23c..919b3229d7ea5 100644
--- a/pkgs/development/libraries/aws-c-sdkutils/default.nix
+++ b/pkgs/development/libraries/aws-c-sdkutils/default.nix
@@ -24,7 +24,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index 201837eb53639..28bb15f2a7453 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -67,7 +67,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_DEPS=OFF"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 8bf009ddacba5..889c03676c103 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -85,7 +85,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_DEPS=OFF"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
   ] ++ lib.optional (!customMemoryManagement) "-DCUSTOM_MEMORY_MANAGEMENT=0"
   ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "-DENABLE_TESTING=OFF"
diff --git a/pkgs/development/libraries/caf/default.nix b/pkgs/development/libraries/caf/default.nix
index 045595a84fde7..8640fb6b5c9c9 100644
--- a/pkgs/development/libraries/caf/default.nix
+++ b/pkgs/development/libraries/caf/default.nix
@@ -21,10 +21,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   checkTarget = "test";
-  preCheck = ''
-    export LD_LIBRARY_PATH=$PWD/libcaf_core:$PWD/libcaf_io
-    export DYLD_LIBRARY_PATH=$PWD/libcaf_core:$PWD/libcaf_io
-  '';
 
   meta = with lib; {
     description = "An open source implementation of the actor model in C++";
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index 8f65bd6c5cd7d..9a18d173f1d34 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -52,9 +52,16 @@ in stdenv.mkDerivation rec {
       url = "https://github.com/freedesktop/cairo/commit/78266cc8c0f7a595cfe8f3b694bfb9bcc3700b38.patch";
       sha256 = "048nzfz7rkgqb9xs0dfs56qdw7ckkxr87nbj3p0qziqdq4nb6wki";
     })
-  ] ++ optionals stdenv.hostPlatform.isDarwin [
+
     # Workaround https://gitlab.freedesktop.org/cairo/cairo/-/issues/121
     ./skip-configure-stderr-check.patch
+
+    # Fixes cairo crash on macOS Big Sur
+    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/-/issues/420
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/e22d7212acb454daccc088619ee147af03883974.diff";
+      sha256 = "sha256-8G98nsPz3MLEWPDX9F0jKgXC4hC4NNdFQLSpmW3ay2s=";
+    })
   ];
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/codec2/default.nix b/pkgs/development/libraries/codec2/default.nix
index e360279c6a441..cc0ef008f82ba 100644
--- a/pkgs/development/libraries/codec2/default.nix
+++ b/pkgs/development/libraries/codec2/default.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
     sed -r -i 's/(\<_Complex)(\s+)(float|double)/\3\2\1/' $out/include/$pname/freedv_api.h
   '';
 
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/freedv_rx contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   meta = with lib; {
     description = "Speech codec designed for communications quality speech at low data rates";
     homepage = "https://www.rowetel.com/codec2.html";
diff --git a/pkgs/development/libraries/cpp-netlib/default.nix b/pkgs/development/libraries/cpp-netlib/default.nix
index 6085a3c849cc2..1effce915515b 100644
--- a/pkgs/development/libraries/cpp-netlib/default.nix
+++ b/pkgs/development/libraries/cpp-netlib/default.nix
@@ -19,11 +19,6 @@ stdenv.mkDerivation rec {
     "-DCPP-NETLIB_BUILD_SHARED_LIBS=ON"
   ];
 
-  # The test driver binary lacks an RPath to the library's libs
-  preCheck = ''
-    export LD_LIBRARY_PATH=$PWD/libs/network/src
-  '';
-
   # Most tests make network GET requests to various websites
   doCheck = false;
 
diff --git a/pkgs/development/libraries/crc32c/default.nix b/pkgs/development/libraries/crc32c/default.nix
index bfd7bee94b658..2ba0c4e65b8ba 100644
--- a/pkgs/development/libraries/crc32c/default.nix
+++ b/pkgs/development/libraries/crc32c/default.nix
@@ -29,8 +29,6 @@ stdenv.mkDerivation rec {
     "-DCRC32C_BUILD_BENCHMARKS=0"
     "-DCRC32C_USE_GLOG=0"
     "-DBUILD_SHARED_LIBS=${if staticOnly then "0" else "1"}"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # for tests
   ];
 
   doCheck = false;
diff --git a/pkgs/development/libraries/criterion/default.nix b/pkgs/development/libraries/criterion/default.nix
index a1e7137d92ab6..723865ab11d3a 100644
--- a/pkgs/development/libraries/criterion/default.nix
+++ b/pkgs/development/libraries/criterion/default.nix
@@ -27,9 +27,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DCTESTS=ON" ];
   doCheck = true;
-  preCheck = ''
-    export LD_LIBRARY_PATH=`pwd`''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
-  '';
   checkTarget = "criterion_tests test";
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/ctpp2/default.nix b/pkgs/development/libraries/ctpp2/default.nix
index 626606d0526dc..c8bc708a2aa9f 100644
--- a/pkgs/development/libraries/ctpp2/default.nix
+++ b/pkgs/development/libraries/ctpp2/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
     sed -ie 's/<stdlib.h>/<stdlib.h>\n#include <unistd.h>/' src/CTPP2FileSourceLoader.cpp
   '';
 
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/ctpp2json contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   doCheck = false; # fails
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/cutelyst/default.nix b/pkgs/development/libraries/cutelyst/default.nix
index d7fe4e92802b2..51336a9e1a55b 100644
--- a/pkgs/development/libraries/cutelyst/default.nix
+++ b/pkgs/development/libraries/cutelyst/default.nix
@@ -31,14 +31,6 @@ stdenv.mkDerivation rec {
     "-DPLUGIN_VIEW_GRANTLEE=ON"
   ];
 
-  preBuild = lib.optionalString stdenv.isLinux ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}`pwd`/Cutelyst:`pwd`/EventLoopEPoll"
-  '';
-
-  postBuild = lib.optionalString stdenv.isLinux ''
-    unset LD_LIBRARY_PATH
-  '';
-
   meta = with lib; {
     description = "C++ Web Framework built on top of Qt";
     homepage = "https://cutelyst.org/";
diff --git a/pkgs/development/libraries/docopt_cpp/default.nix b/pkgs/development/libraries/docopt_cpp/default.nix
index 4fae1db9ba3c3..2e37e073fb656 100644
--- a/pkgs/development/libraries/docopt_cpp/default.nix
+++ b/pkgs/development/libraries/docopt_cpp/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
                 "@CMAKE_INSTALL_LIBDIR@"
   '';
 
-  checkPhase = "LD_LIBRARY_PATH=$(pwd) python ./run_tests";
+  checkPhase = "python ./run_tests";
 
   meta = with lib; {
     description = "C++11 port of docopt";
diff --git a/pkgs/development/libraries/fcppt/default.nix b/pkgs/development/libraries/fcppt/default.nix
index f9259e23c2b67..1a82a9289a616 100644
--- a/pkgs/development/libraries/fcppt/default.nix
+++ b/pkgs/development/libraries/fcppt/default.nix
@@ -14,7 +14,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ boost catch2 ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=false"
     "-DENABLE_BOOST=true"
     "-DENABLE_EXAMPLES=true"
     "-DENABLE_CATCH=true"
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 516c7546f564b..9e7dcfd751cba 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -6,8 +6,8 @@
 }@args:
 
 callPackage ./generic.nix (rec {
-  version = "4.4.1";
+  version = "4.4.2";
   branch = version;
-  sha256 = "0hmck0placn12kd9l0wam70mrpgfs2nlfmi8krd135gdql5g5jcg";
+  sha256 = "sha256-+YpIJSDEdQdSGpB5FNqp77wThOBZG1r8PaGKqJfeKUg=";
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 } // args)
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 4eb614d6e653c..682b1aecf1e49 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -238,8 +238,7 @@ stdenv.mkDerivation rec {
       a corporation.
     '';
     license = licenses.gpl3;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ codyopel ];
+    maintainers = with maintainers; [ ];
     inherit branch knownVulnerabilities;
   };
 }
diff --git a/pkgs/development/libraries/fltk/common.nix b/pkgs/development/libraries/fltk/common.nix
index 6d0f90956b251..426a85e6a220a 100644
--- a/pkgs/development/libraries/fltk/common.nix
+++ b/pkgs/development/libraries/fltk/common.nix
@@ -147,6 +147,9 @@ stdenv.mkDerivation rec {
     "-DOPTION_INSTALL_HTML_DOCUMENTATION=${onOff withDocs}"
     "-DOPTION_INSTALL_PDF_DOCUMENTATION=OFF"
     "-DOPTION_INCLUDE_DRIVER_DOCUMENTATION=${onOff withDocs}"
+
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
   preBuild = lib.optionalString (withCairo && withShared && stdenv.hostPlatform.isDarwin) ''
diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix
index 3fee016175bc2..f22d505e3a502 100644
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -23,7 +23,6 @@ let
 
       cmakeFlags = [
         "-DBUILD_SHARED_LIBS=${if enableShared then "ON" else "OFF"}"
-        "-DCMAKE_SKIP_BUILD_RPATH=OFF" # for tests
       ];
 
       doCheck = true;
diff --git a/pkgs/development/libraries/galario/default.nix b/pkgs/development/libraries/galario/default.nix
index 7fb93a61a0feb..ac7e4f4255e84 100644
--- a/pkgs/development/libraries/galario/default.nix
+++ b/pkgs/development/libraries/galario/default.nix
@@ -53,6 +53,11 @@ stdenv.mkDerivation rec {
     ${if enablePython then "sed -i -e 's|^#!.*|#!${stdenv.shell}|' python/py.test.sh" else ""}
   '';
 
+  cmakeFlags = lib.optionals enablePython [
+    # RPATH of binary /nix/store/.../lib/python3.10/site-packages/galario/double/libcommon.so contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   doCheck = true;
 
   postInstall = lib.optionalString (stdenv.isDarwin && enablePython) ''
diff --git a/pkgs/development/libraries/glog/default.nix b/pkgs/development/libraries/glog/default.nix
index 98ae294c48023..f49c8b982993d 100644
--- a/pkgs/development/libraries/glog/default.nix
+++ b/pkgs/development/libraries/glog/default.nix
@@ -17,9 +17,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
-    # Mak CMake place RPATHs such that tests will find the built libraries.
-    # See https://github.com/NixOS/nixpkgs/pull/144561#discussion_r742468811 and https://github.com/NixOS/nixpkgs/pull/108496
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
   ];
 
   # TODO: Re-enable Darwin tests once we're on a release that has https://github.com/google/glog/issues/709#issuecomment-960381653 fixed
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 0144cec39e934..9ba791e073ca0 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.46.3"; # N.B: if you change this, please update:
+  version = "1.47.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    sha256 = "sha256-RiXtKlRtlbqwrSxI904dgSu3da0A6Fwk+/hWHIG7A5E=";
+    sha256 = "sha256-fMYAos0gQelFMPkpR0DdKr4wPX+nhZSSqeaU4URqgto=";
     fetchSubmodules = true;
   };
 
@@ -61,7 +61,6 @@ stdenv.mkDerivation rec {
     "-DgRPC_PROTOBUF_PROVIDER=package"
     "-DgRPC_ABSL_PROVIDER=package"
     "-DBUILD_SHARED_LIBS=ON"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-D_gRPC_PROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc"
   ] ++ lib.optionals ((stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "11.0") [
diff --git a/pkgs/development/libraries/igraph/default.nix b/pkgs/development/libraries/igraph/default.nix
index b598d846f9e2e..e36793debdff8 100644
--- a/pkgs/development/libraries/igraph/default.nix
+++ b/pkgs/development/libraries/igraph/default.nix
@@ -87,13 +87,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  # needed to find libigraph, and liblas on darwin
-  preCheck = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [ blas ]}:$PWD/src"
-  '' else ''
-    export LD_LIBRARY_PATH="$PWD/src"
-  '';
-
   postInstall = ''
     mkdir -p "$out/share"
     cp -r doc "$out/share"
diff --git a/pkgs/development/libraries/jsoncpp/default.nix b/pkgs/development/libraries/jsoncpp/default.nix
index 77d49c700030c..d9cf9a6c43464 100644
--- a/pkgs/development/libraries/jsoncpp/default.nix
+++ b/pkgs/development/libraries/jsoncpp/default.nix
@@ -43,14 +43,6 @@ stdenv.mkDerivation rec {
     sed -i 's/#define JSONCPP_USING_SECURE_MEMORY 0/#define JSONCPP_USING_SECURE_MEMORY 1/' include/json/version.h
   '';
 
-  # Hack to be able to run the test, broken because we use
-  # CMAKE_SKIP_BUILD_RPATH to avoid cmake resetting rpath on install
-  preBuild = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="$PWD/lib''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
-  '' else ''
-    export LD_LIBRARY_PATH="$PWD/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-  '';
-
   nativeBuildInputs = [ cmake python3 validatePkgConfig ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index bbb11522dee51..7397824f9a76e 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, perl, bison, bootstrap_cmds
 , openssl, openldap, libedit, keyutils
+, nixosTests
 
 # Extra Arguments
 , type ? ""
@@ -16,56 +17,62 @@
 let
   libOnly = type == "lib";
 in
-with lib;
 stdenv.mkDerivation rec {
   pname = "${type}krb5";
-  version = "1.19.3";
+  version = "1.20";
 
   src = fetchurl {
-    url = "https://kerberos.org/dist/krb5/${versions.majorMinor version}/krb5-${version}.tar.gz";
-    sha256 = "1l6wp58zav37g03n2ig5qr0pslz38gh5cxgigbmxkjfxrxilil2n";
+    url = "https://kerberos.org/dist/krb5/${lib.versions.majorMinor version}/krb5-${version}.tar.gz";
+    sha256 = "sha256-fgIr3TyFGDAXP5+qoAaiMKDg/a1MlT6Fv/S/DaA24S8";
   };
 
   outputs = [ "out" "dev" ];
 
-  configureFlags = [ "--with-tcl=no" "--localstatedir=/var/lib"]
+  configureFlags = [ "--localstatedir=/var/lib" ]
     # krb5's ./configure does not allow passing --enable-shared and --enable-static at the same time.
     # See https://bbs.archlinux.org/viewtopic.php?pid=1576737#p1576737
-    ++ optional staticOnly [ "--enable-static" "--disable-shared" ]
-    ++ optional stdenv.isFreeBSD ''WARN_CFLAGS=""''
-    ++ optionals (stdenv.buildPlatform != stdenv.hostPlatform)
+    ++ lib.optional staticOnly [ "--enable-static" "--disable-shared" ]
+    ++ lib.optional stdenv.isFreeBSD ''WARN_CFLAGS=""''
+    ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
        [ "krb5_cv_attr_constructor_destructor=yes,yes"
          "ac_cv_func_regcomp=yes"
          "ac_cv_printf_positional=yes"
        ];
 
   nativeBuildInputs = [ pkg-config perl ]
-    ++ optional (!libOnly) bison
+    ++ lib.optional (!libOnly) bison
     # Provides the mig command used by the build scripts
-    ++ optional stdenv.isDarwin bootstrap_cmds;
+    ++ lib.optional stdenv.isDarwin bootstrap_cmds;
 
   buildInputs = [ openssl ]
-    ++ optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.libc != "bionic" && !(stdenv.hostPlatform.useLLVM or false)) [ keyutils ]
-    ++ optionals (!libOnly) [ openldap libedit ];
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.libc != "bionic" && !(stdenv.hostPlatform.useLLVM or false)) [ keyutils ]
+    ++ lib.optionals (!libOnly) [ openldap libedit ];
 
-  preConfigure = "cd ./src";
+  sourceRoot = "krb5-${version}/src";
+
+  libFolders = [ "util" "include" "lib" "build-tools" ];
+
+  buildPhase = lib.optionalString libOnly ''
+    runHook preBuild
 
-  buildPhase = optionalString libOnly ''
     MAKE="make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES"
-    (cd util; $MAKE)
-    (cd include; $MAKE)
-    (cd lib; $MAKE)
-    (cd build-tools; $MAKE)
+    for folder in $libFolders; do
+      $MAKE -C $folder
+    done
+
+    runHook postBuild
   '';
 
-  installPhase = optionalString libOnly ''
+  installPhase = lib.optionalString libOnly ''
+    runHook preInstall
+
     mkdir -p "$out"/{bin,sbin,lib/pkgconfig,share/{et,man/man1}} \
       "$dev"/include/{gssapi,gssrpc,kadm5,krb5}
-    (cd util; $MAKE install)
-    (cd include; $MAKE install)
-    (cd lib; $MAKE install)
-    (cd build-tools; $MAKE install)
-    ${postInstall}
+    for folder in $libFolders; do
+      $MAKE -C $folder install
+    done
+
+    runHook postInstall
   '';
 
   # not via outputBin, due to reference from libkrb5.so
@@ -76,12 +83,15 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   doCheck = false; # fails with "No suitable file for testing purposes"
 
-  meta = {
+  meta = with lib; {
     description = "MIT Kerberos 5";
     homepage = "http://web.mit.edu/kerberos/";
     license = licenses.mit;
     platforms = platforms.unix ++ platforms.windows;
   };
 
-  passthru.implementation = "krb5";
+  passthru = {
+    implementation = "krb5";
+    tests = { inherit (nixosTests) kerberos; };
+  };
 }
diff --git a/pkgs/development/libraries/leveldb/default.nix b/pkgs/development/libraries/leveldb/default.nix
index a6f75413c91e7..8cac5df55ea20 100644
--- a/pkgs/development/libraries/leveldb/default.nix
+++ b/pkgs/development/libraries/leveldb/default.nix
@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
   # NOTE: disabling tests due to gtest issue
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DLEVELDB_BUILD_TESTS=OFF"
     "-DLEVELDB_BUILD_BENCHMARKS=OFF"
   ];
diff --git a/pkgs/development/libraries/lib2geom/default.nix b/pkgs/development/libraries/lib2geom/default.nix
index 755ed6b814e6e..92cc1424af9fa 100644
--- a/pkgs/development/libraries/lib2geom/default.nix
+++ b/pkgs/development/libraries/lib2geom/default.nix
@@ -44,7 +44,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # for tests
     "-D2GEOM_BUILD_SHARED=ON"
   ];
 
diff --git a/pkgs/development/libraries/libcef/default.nix b/pkgs/development/libraries/libcef/default.nix
index 87471114a87b6..96f53a33b1eb0 100644
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  cmakeFlags = "-DPROJECT_ARCH=${platformInfo.projectArch}";
+  cmakeFlags = [ "-DPROJECT_ARCH=${platformInfo.projectArch}" ];
   makeFlags = [ "libcef_dll_wrapper" ];
   dontStrip = true;
   dontPatchELF = true;
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 90963cf516b24..9f7f5fcb1d8fd 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.111";
+  version = "2.4.112";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1adjg96mz0ghjzsgp9hrdr622shrvqmjcz5sxksfcka2fx7idmqs";
+    sha256 = "1zr0hi7k5s7my4q9hyj6ryzg89zyjx24zbqfv3c5rcq9pl87gc00";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 352c810e81a6e..be0a4fb915499 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -129,16 +129,6 @@ stdenv.mkDerivation rec {
 
   doCheck = !stdenv.hostPlatform.isi686;
 
-  # The test driver runs a test `LibraryCLinkageTest` which without
-  # LD_LIBRARY_PATH setting errors with:
-  #     /build/source/build/tools/tests/libjxl_test: error while loading shared libraries: libjxl.so.0
-  # The required file is in the build directory (`$PWD`).
-  preCheck = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD
-  '' else ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/libjxl/libjxl";
     description = "JPEG XL image format reference implementation.";
diff --git a/pkgs/development/libraries/libminc/default.nix b/pkgs/development/libraries/libminc/default.nix
index 2440082cce9d7..f1f6dc1b374f1 100644
--- a/pkgs/development/libraries/libminc/default.nix
+++ b/pkgs/development/libraries/libminc/default.nix
@@ -29,7 +29,6 @@ stdenv.mkDerivation rec {
 
   doCheck = !stdenv.isDarwin;
   checkPhase = ''
-    export LD_LIBRARY_PATH="$(pwd)"  # see #22060
     ctest -j1 -E 'ezminc_rw_test' --output-on-failure
     # -j1: see https://github.com/BIC-MNI/libminc/issues/110
     # ezminc_rw_test: can't find libminc_io.so.5.2.0
diff --git a/pkgs/development/libraries/libpointmatcher/default.nix b/pkgs/development/libraries/libpointmatcher/default.nix
index 31fb5cb05ba79..01c3e3e87e43f 100644
--- a/pkgs/development/libraries/libpointmatcher/default.nix
+++ b/pkgs/development/libraries/libpointmatcher/default.nix
@@ -20,7 +20,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   checkPhase = ''
-    export LD_LIBRARY_PATH=$PWD
     ./utest/utest --path ../examples/data/
   '';
 
diff --git a/pkgs/development/libraries/libqtav/default.nix b/pkgs/development/libraries/libqtav/default.nix
index 090291a120f77..c2d91b1d5b734 100644
--- a/pkgs/development/libraries/libqtav/default.nix
+++ b/pkgs/development/libraries/libqtav/default.nix
@@ -52,6 +52,11 @@ mkDerivation rec {
   # the other libraries as `libGL` is part of our `buildInputs`.
   NIX_CFLAGS_LINK = "-Wl,-rpath,${libGL}/lib";
 
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   preFixup = ''
     mkdir -p "$out/bin"
     cp -a "./bin/"* "$out/bin"
diff --git a/pkgs/development/libraries/libtiff/aarch64-darwin.nix b/pkgs/development/libraries/libtiff/aarch64-darwin.nix
index 5de481066f67d..521db8ff7993c 100644
--- a/pkgs/development/libraries/libtiff/aarch64-darwin.nix
+++ b/pkgs/development/libraries/libtiff/aarch64-darwin.nix
@@ -19,8 +19,6 @@ stdenv.mkDerivation rec {
     sha256 = "1jrkjv0xya9radddn8idxvs2gqzp3l2b1s8knlizmn7ad3jq817b";
   };
 
-  cmakeFlags = lib.optional stdenv.isDarwin "-DCMAKE_SKIP_BUILD_RPATH=OFF";
-
   # FreeImage needs this patch
   patches = [ ./headers-cmake.patch ];
 
diff --git a/pkgs/development/libraries/libtins/default.nix b/pkgs/development/libraries/libtins/default.nix
index b7e02a62fa996..b96c02a35bfd4 100644
--- a/pkgs/development/libraries/libtins/default.nix
+++ b/pkgs/development/libraries/libtins/default.nix
@@ -30,10 +30,6 @@ stdenv.mkDerivation rec {
   ];
 
   doCheck = true;
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD${placeholder "out"}/lib
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD${placeholder "out"}/lib
-  '';
   checkTarget = "tests test";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libuchardet/default.nix b/pkgs/development/libraries/libuchardet/default.nix
index 8bf2e2acff9f9..6b39995f39b9c 100644
--- a/pkgs/development/libraries/libuchardet/default.nix
+++ b/pkgs/development/libraries/libuchardet/default.nix
@@ -13,10 +13,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # for tests
-  ];
-
   doCheck = !stdenv.isi686; # tests fail on i686
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libversion/default.nix b/pkgs/development/libraries/libversion/default.nix
index 98ad4ef7feec8..c8af82d04917f 100644
--- a/pkgs/development/libraries/libversion/default.nix
+++ b/pkgs/development/libraries/libversion/default.nix
@@ -13,13 +13,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = lib.optional stdenv.isDarwin [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # needed for tests
-  ];
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=/build/source/build/libversion/''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
-  '';
   doCheck = true;
   checkTarget = "test";
 
diff --git a/pkgs/development/libraries/libvisio2svg/default.nix b/pkgs/development/libraries/libvisio2svg/default.nix
index 0525ba80b4f9e..b2a68ed586808 100644
--- a/pkgs/development/libraries/libvisio2svg/default.nix
+++ b/pkgs/development/libraries/libvisio2svg/default.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libxml2 freetype librevenge libvisio libwmf libemf2svg ];
 
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   meta = with lib; {
     description = "Library and tools to convert Microsoft Visio documents (VSS and VSD) to SVG";
     homepage = "https://github.com/kakwa/libvisio2svg";
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index da75d3a915045..f90de7fc6effe 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -5,7 +5,6 @@
 , jpegSupport ? true, libjpeg # JPEG image format
 , tiffSupport ? true, libtiff # TIFF image format
 , gifSupport ? true, giflib # GIF image format
-#, wicSupport ? true # Windows Imaging Component
 , alignedSupport ? false # Force aligned memory operations
 , swap16bitcspSupport ? false # Byte swap for 16bit color spaces
 , experimentalSupport ? false # Experimental code
@@ -14,55 +13,49 @@
 , libwebpdecoderSupport ? true # Build libwebpdecoder
 }:
 
-let
-  mkFlag = optSet: flag: if optSet then "--enable-${flag}" else "--disable-${flag}";
-in
-
-with lib;
 stdenv.mkDerivation rec {
   pname = "libwebp";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner  = "webmproject";
     repo   = pname;
     rev    = "v${version}";
-    hash   = "sha256-KrvB5d3KNmujbfekWaevz2JZrWtK3PjEG9NEzRBYIDw=";
+    hash   = "sha256-WF2HZPS7mbotk+d1oLM/JC5l/FWfkrk+T3Z6EW9oYEI=";
   };
 
   prePatch = "patchShebangs .";
 
   configureFlags = [
-    (mkFlag threadingSupport "threading")
-    (mkFlag openglSupport "gl")
-    (mkFlag pngSupport "png")
-    (mkFlag jpegSupport "jpeg")
-    (mkFlag tiffSupport "tiff")
-    (mkFlag gifSupport "gif")
-    #(mkFlag (wicSupport && stdenv.isCygwin) "wic")
-    (mkFlag alignedSupport "aligned")
-    (mkFlag swap16bitcspSupport "swap-16bit-csp")
-    (mkFlag experimentalSupport "experimental")
-    (mkFlag libwebpmuxSupport "libwebpmux")
-    (mkFlag libwebpdemuxSupport "libwebpdemux")
-    (mkFlag libwebpdecoderSupport "libwebpdecoder")
+    (lib.enableFeature threadingSupport "threading")
+    (lib.enableFeature openglSupport "gl")
+    (lib.enableFeature pngSupport "png")
+    (lib.enableFeature jpegSupport "jpeg")
+    (lib.enableFeature tiffSupport "tiff")
+    (lib.enableFeature gifSupport "gif")
+    (lib.enableFeature alignedSupport "aligned")
+    (lib.enableFeature swap16bitcspSupport "swap-16bit-csp")
+    (lib.enableFeature experimentalSupport "experimental")
+    (lib.enableFeature libwebpmuxSupport "libwebpmux")
+    (lib.enableFeature libwebpdemuxSupport "libwebpdemux")
+    (lib.enableFeature libwebpdecoderSupport "libwebpdecoder")
   ];
 
   nativeBuildInputs = [ autoreconfHook libtool ];
   buildInputs = [ ]
-    ++ optionals openglSupport [ freeglut libGL libGLU ]
-    ++ optional pngSupport libpng
-    ++ optional jpegSupport libjpeg
-    ++ optional tiffSupport libtiff
-    ++ optional gifSupport giflib;
+    ++ lib.optionals openglSupport [ freeglut libGL libGLU ]
+    ++ lib.optionals pngSupport [ libpng ]
+    ++ lib.optionals jpegSupport [ libjpeg ]
+    ++ lib.optionals tiffSupport [ libtiff ]
+    ++ lib.optionals gifSupport [ giflib ];
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with lib; {
     description = "Tools and library for the WebP image format";
     homepage = "https://developers.google.com/speed/webp/";
     license = licenses.bsd3;
     platforms = platforms.all;
-    maintainers = with maintainers; [ codyopel ];
+    maintainers = with maintainers; [ ajs124 ];
   };
 }
diff --git a/pkgs/development/libraries/libxc/default.nix b/pkgs/development/libraries/libxc/default.nix
index f28420229ab99..5091489ba72a5 100644
--- a/pkgs/development/libraries/libxc/default.nix
+++ b/pkgs/development/libraries/libxc/default.nix
@@ -20,8 +20,6 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DENABLE_FORTRAN=ON"
     "-DBUILD_SHARED_LIBS=ON"
-    # needed for tests to link
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     # Force compilation of higher derivatives
     "-DDISABLE_VXC=0"
     "-DDISABLE_FXC=0"
diff --git a/pkgs/development/libraries/mailcore2/default.nix b/pkgs/development/libraries/mailcore2/default.nix
index 4e5a5fdbcdbca..65e35217f80a2 100644
--- a/pkgs/development/libraries/mailcore2/default.nix
+++ b/pkgs/development/libraries/mailcore2/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   checkPhase = ''
     (
       cd unittest
-      LD_LIBRARY_PATH="$(cd ../src; pwd)" TZ=PST8PDT ./unittestcpp ../../unittest/data
+      TZ=PST8PDT ./unittestcpp ../../unittest/data
     )
   '';
 
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 0e10135d3d391..66245951bc6dc 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -35,7 +35,7 @@ let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
   # 22.1 on darwin won't build: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6519
-  version = if stdenv.isDarwin then "22.0.4" else "22.1.1";
+  version = if stdenv.isDarwin then "22.0.4" else "22.1.3";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -50,7 +50,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
     sha256 = {
-      "22.1.1" = "1w8fpki67238l4yc92hsnsh4402py9zspirbmirxp577zxjhi526";
+      "22.1.3" = "1qwky31vdqh3y6i0mxqnrbq7jc39kjcyndpv4mbzz8d2gax353xr";
       "22.0.4" = "1m0y8wgy48hmcidsr7sbk5hcw3v0qr8359fd2x34fvl2z9c1z5y7";
     }.${version};
   };
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index 11a63a3cd5ce4..9cf5da3e395b0 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -60,6 +60,11 @@ mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   qtWrapperArgs = [
     "--prefix FREI0R_PATH : ${frei0r}/lib/frei0r-1"
     "--prefix LADSPA_PATH : ${ladspaPlugins}/lib/ladspa"
diff --git a/pkgs/development/libraries/oneDNN/default.nix b/pkgs/development/libraries/oneDNN/default.nix
index 42f05a6561632..a4c4bb057251a 100644
--- a/pkgs/development/libraries/oneDNN/default.nix
+++ b/pkgs/development/libraries/oneDNN/default.nix
@@ -21,12 +21,6 @@ stdenv.mkDerivation rec {
   # Tests fail on some Hydra builders, because they do not support SSE4.2.
   doCheck = false;
 
-  # The test driver doesn't add an RPath to the build libdir
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/src
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD/src
-  '';
-
   # The cmake install gets tripped up and installs a nix tree into $out, in
   # addition to the correct install; clean it up.
   postInstall = ''
diff --git a/pkgs/development/libraries/openhmd/default.nix b/pkgs/development/libraries/openhmd/default.nix
index a692dcb5e4e39..ce0630bee62fc 100644
--- a/pkgs/development/libraries/openhmd/default.nix
+++ b/pkgs/development/libraries/openhmd/default.nix
@@ -37,6 +37,9 @@ stdenv.mkDerivation rec {
     "-DOPENHMD_EXAMPLE_SIMPLE=${examplesOnOff}"
     "-DOPENHMD_EXAMPLE_SDL=${examplesOnOff}"
     "-DOpenGL_GL_PREFERENCE=GLVND"
+
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
   postInstall = lib.optionalString withExamples ''
diff --git a/pkgs/development/libraries/openssl/3.0/rsa-fix-bn_reduce_once_in_place-call-for-rsaz_mod_exp_avx512_x2.patch b/pkgs/development/libraries/openssl/3.0/rsa-fix-bn_reduce_once_in_place-call-for-rsaz_mod_exp_avx512_x2.patch
deleted file mode 100644
index e144a7188897e..0000000000000
--- a/pkgs/development/libraries/openssl/3.0/rsa-fix-bn_reduce_once_in_place-call-for-rsaz_mod_exp_avx512_x2.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 4d8a88c134df634ba610ff8db1eb8478ac5fd345 Mon Sep 17 00:00:00 2001
-From: Xi Ruoyao <xry111@xry111.site>
-Date: Wed, 22 Jun 2022 18:07:05 +0800
-Subject: [PATCH] rsa: fix bn_reduce_once_in_place call for
- rsaz_mod_exp_avx512_x2
-
-bn_reduce_once_in_place expects the number of BN_ULONG, but factor_size
-is moduli bit size.
-
-Fixes #18625.
-
-Signed-off-by: Xi Ruoyao <xry111@xry111.site>
-
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-Reviewed-by: Paul Dale <pauli@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/18626)
----
- crypto/bn/rsaz_exp_x2.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/crypto/bn/rsaz_exp_x2.c b/crypto/bn/rsaz_exp_x2.c
-index 6b04486e3f56..f979cebd6fb7 100644
---- a/crypto/bn/rsaz_exp_x2.c
-+++ b/crypto/bn/rsaz_exp_x2.c
-@@ -257,6 +257,9 @@ int ossl_rsaz_mod_exp_avx512_x2(BN_ULONG *res1,
-     from_words52(res1, factor_size, rr1_red);
-     from_words52(res2, factor_size, rr2_red);
- 
-+    /* bn_reduce_once_in_place expects number of BN_ULONG, not bit size */
-+    factor_size /= sizeof(BN_ULONG) * 8;
-+
-     bn_reduce_once_in_place(res1, /*carry=*/0, m1, storage, factor_size);
-     bn_reduce_once_in_place(res2, /*carry=*/0, m2, storage, factor_size);
- 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index db6e0101fec78..74e5d318bcb68 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -186,8 +186,8 @@ in {
 
 
   openssl_1_1 = common rec {
-    version = "1.1.1p";
-    sha256 = "sha256-v2G2Kqpmx8djmUKpTeTJroKAwI8X1OrC5EZE2fyKzm8=";
+    version = "1.1.1q";
+    sha256 = "sha256-15Oc5hQCnN/wtsIPDi5XAxWKSJpyslB7i9Ub+Mj9EMo=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -201,8 +201,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.4";
-    sha256 = "sha256-KDGEPppmigq0eOcCCtY9LWXlH3KXdHLcc+/O+6/AwA8=";
+    version = "3.0.5";
+    sha256 = "sha256-qn2Nm+9xrWUlxVuhHl9Dl4ic5Jwsk0nc6m0+TwsCSno=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
@@ -210,10 +210,6 @@ in {
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
-      # https://guidovranken.com/2022/06/27/notes-on-openssl-remote-memory-corruption/
-      # https://github.com/openssl/openssl/commit/4d8a88c134df634ba610ff8db1eb8478ac5fd345.patch
-      3.0/rsa-fix-bn_reduce_once_in_place-call-for-rsaz_mod_exp_avx512_x2.patch
-
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
diff --git a/pkgs/development/libraries/orcania/default.nix b/pkgs/development/libraries/orcania/default.nix
index 2c43cfb4cc90e..158bc9f405fc4 100644
--- a/pkgs/development/libraries/orcania/default.nix
+++ b/pkgs/development/libraries/orcania/default.nix
@@ -18,11 +18,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  preCheck = ''
-    export LD_LIBRARY_PATH="$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-    export DYLD_FALLBACK_LIBRARY_PATH="$(pwd):$DYLD_FALLBACK_LIBRARY_PATH"
-  '';
-
   meta = with lib; {
     description = "Potluck with different functions for different purposes that can be shared among C programs";
     homepage = "https://github.com/babelouest/orcania";
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index c60787d5b6220..1f7790294dd11 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -2,7 +2,6 @@
 , lib
 , buildPackages
 , fetchFromGitLab
-, fetchpatch
 , removeReferencesTo
 , python3
 , meson
@@ -70,7 +69,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.52";
+    version = "0.3.54";
 
     outputs = [
       "out"
@@ -88,7 +87,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-JWmO36+OF2O9sLB+Z0znwm3TH+O+pEv3cXnuwP6Wy1E=";
+      sha256 = "sha256-EFkx/K5v4f7clFguiU1xFt9VacSHeVksRye73rOjPPI=";
     };
 
     patches = [
@@ -104,12 +103,6 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
-      # Remove 44.1KHz from allowed rates (multiple regressions reported)
-      # To be removed when 0.3.53 is released
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/16a7c274989f47b0c0d8ba192a30316b545bd26a.patch";
-        sha256 = "sha256-VZ7ChjcR/PGfmH2DmLxfIhd3mj9668l9zLO4k2KBoqg=";
-      })
     ];
 
     nativeBuildInputs = [
diff --git a/pkgs/development/libraries/plplot/default.nix b/pkgs/development/libraries/plplot/default.nix
index dca1248b8b6b4..f3a703ce18785 100644
--- a/pkgs/development/libraries/plplot/default.nix
+++ b/pkgs/development/libraries/plplot/default.nix
@@ -33,7 +33,9 @@ in stdenv.mkDerivation rec {
     ;
   };
 
-  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=OFF" "-DBUILD_TEST=ON" ];
+  cmakeFlags = [
+    "-DBUILD_TEST=ON"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/pugixml/default.nix b/pkgs/development/libraries/pugixml/default.nix
index c976db8822571..73d890e03a41f 100644
--- a/pkgs/development/libraries/pugixml/default.nix
+++ b/pkgs/development/libraries/pugixml/default.nix
@@ -22,14 +22,6 @@ stdenv.mkDerivation rec {
 
   checkInputs = [ check ];
 
-  # Hack to be able to run the test, broken because we use
-  # CMAKE_SKIP_BUILD_RPATH to avoid cmake resetting rpath on install
-  preCheck = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="$(pwd)''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
-  '' else ''
-    export LD_LIBRARY_PATH="$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-  '';
-
   preConfigure = ''
     # Enable long long support (required for filezilla)
     sed -ire '/PUGIXML_HAS_LONG_LONG/ s/^\/\///' src/pugiconfig.hpp
diff --git a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0001-qtbase-mkspecs-mac.patch b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
index 3a2900abdd6be..b50913753614a 100644
--- a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
@@ -30,7 +30,54 @@ diff --git a/mkspecs/features/mac/default_post.prf b/mkspecs/features/mac/defaul
 index 92a9112bca..b80ec1e801 100644
 --- a/mkspecs/features/mac/default_post.prf
 +++ b/mkspecs/features/mac/default_post.prf
-@@ -68,212 +68,6 @@ qt {
+@@ -1,9 +1,5 @@
+ load(default_post)
+ 
+-# Recompute SDK version in case the user set it explicitly
+-sdk_version = $$QMAKE_MAC_SDK_VERSION
+-QMAKE_MAC_SDK_VERSION = $$xcodeSDKInfo(SDKVersion)
+-
+ contains(TEMPLATE, .*app) {
+     !macx-xcode:if(isEmpty(BUILDS)|build_pass) {
+         # Detect changes to the platform SDK
+@@ -16,36 +12,6 @@ contains(TEMPLATE, .*app) {
+         QMAKE_EXTRA_INCLUDES += $$shell_quote($$PWD/sdk.mk)
+     }
+ 
+-    # Detect incompatible SDK versions
+-
+-    isEmpty(QT_MAC_SDK_VERSION_MIN): \
+-        QT_MAC_SDK_VERSION_MIN = $$QT_MAC_SDK_VERSION
+-
+-    !versionAtLeast(QMAKE_MAC_SDK_VERSION, $$QT_MAC_SDK_VERSION_MIN): \
+-        warning("Qt requires at least version $$QT_MAC_SDK_VERSION_MIN of the platform SDK," \
+-              "you're building against version $${QMAKE_MAC_SDK_VERSION}. Please upgrade.")
+-
+-    !isEmpty(QT_MAC_SDK_VERSION_MAX) {
+-        # For Qt developers only
+-        !isEmpty($$list($$(QT_MAC_SDK_NO_VERSION_CHECK))): \
+-            CONFIG += sdk_no_version_check
+-
+-        QMAKE_MAC_SDK_MAJOR_VERSION = $$replace(QMAKE_MAC_SDK_VERSION, "(\\d+)(\\.\\d+)(\\.\\d+)?", \\1)
+-
+-        !sdk_no_version_check:!versionAtMost(QMAKE_MAC_SDK_MAJOR_VERSION, $$QT_MAC_SDK_VERSION_MAX) {
+-            warning("Qt has only been tested with version $$QT_MAC_SDK_VERSION_MAX"\
+-                    "of the platform SDK, you're using $${QMAKE_MAC_SDK_MAJOR_MINOR_VERSION}.")
+-            warning("This is an unsupported configuration. You may experience build issues," \
+-                    "and by using")
+-            warning("the $$QMAKE_MAC_SDK_VERSION SDK you are opting in to new features" \
+-                    "that Qt has not been prepared for.")
+-
+-            warning("Please downgrade the SDK you use to build your app to version" \
+-                    "$$QT_MAC_SDK_VERSION_MAX, or configure")
+-            warning("with CONFIG+=sdk_no_version_check when running qmake" \
+-                    "to silence this warning.")
+-        }
+-    }
+ }
+ 
+ !no_objective_c:CONFIG += objective_c
+@@ -73,212 +39,6 @@ qt {
      }
  }
  
@@ -308,35 +355,6 @@ index e3534561a5..3b01424e67 100644
 -xcode_copy_phase_strip_setting.name = COPY_PHASE_STRIP
 -xcode_copy_phase_strip_setting.value = NO
 -QMAKE_MAC_XCODE_SETTINGS += xcode_copy_phase_strip_setting
-diff --git a/mkspecs/features/mac/sdk.mk b/mkspecs/features/mac/sdk.mk
---- a/mkspecs/features/mac/sdk.mk
-+++ b/mkspecs/features/mac/sdk.mk
-@@ -1,25 +0,0 @@
--
--ifeq ($(QT_MAC_SDK_NO_VERSION_CHECK),)
--    CHECK_SDK_COMMAND = /usr/bin/xcrun --sdk $(EXPORT_QMAKE_MAC_SDK) -show-sdk-version 2>&1
--    CURRENT_MAC_SDK_VERSION := $(shell DEVELOPER_DIR=$(EXPORT_QMAKE_XCODE_DEVELOPER_PATH) $(CHECK_SDK_COMMAND))
--    ifneq ($(CURRENT_MAC_SDK_VERSION),$(EXPORT_QMAKE_MAC_SDK_VERSION))
--        # We don't want to complain about out of date SDK unless the target needs to be remade.
--        # This covers use-cases such as running 'make check' after moving the build to a
--        # computer without Xcode or with a different Xcode version.
--        TARGET_UP_TO_DATE := $(shell QT_MAC_SDK_NO_VERSION_CHECK=1 $(MAKE) --question $(QMAKE_TARGET) && echo 1 || echo 0)
--        ifeq ($(TARGET_UP_TO_DATE),0)
--            ifneq ($(findstring missing DEVELOPER_DIR path,$(CURRENT_MAC_SDK_VERSION)),)
--                $(info The developer dir $(EXPORT_QMAKE_XCODE_DEVELOPER_PATH) is no longer valid.)
--            else ifneq ($(findstring SDK "$(EXPORT_QMAKE_MAC_SDK)" cannot be located,$(CURRENT_MAC_SDK_VERSION)),)
--                $(info The developer dir $(EXPORT_QMAKE_XCODE_DEVELOPER_PATH) no longer contains the $(EXPORT_QMAKE_MAC_SDK_VERSION) platform SDK.)
--            else ifneq ($(CURRENT_MAC_SDK_VERSION),)
--                $(info The platform SDK has been changed from version $(EXPORT_QMAKE_MAC_SDK_VERSION) to version $(CURRENT_MAC_SDK_VERSION).)
--            else
--                $(info Unknown error resolving current platform SDK version.)
--            endif
--            $(info This requires a fresh build. Please wipe the build directory completely,)
--            $(info including any .qmake.stash and .qmake.cache files generated by qmake.)
--            $(error ^)
--        endif
--    endif
--endif
 diff --git a/mkspecs/features/mac/sdk.prf b/mkspecs/features/mac/sdk.prf
 deleted file mode 100644
 index 3a9c2778bb..0000000000
@@ -404,6 +422,14 @@ index 3a9c2778bb..0000000000
 -    $$tool = $$sysrooted $$member(value, 1, -1)
 -    cache($$tool_variable, set stash, $$tool)
 -}
--- 
-2.25.4
-
+diff --git a/mkspecs/features/mac/toolchain.prf b/mkspecs/features/mac/toolchain.prf
+deleted file mode 100644
+index df191eb13c..0000000000
+--- a/mkspecs/features/mac/toolchain.prf
++++ /dev/null
+@@ -1,5 +0,0 @@
+-# Ensure that we process sdk.prf first, as it will update QMAKE_CXX,
+-# which the default path determination uses.
+-sdk: load(sdk)
+-
+-load(toolchain)
diff --git a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/macos-sdk-10.12/0004-Revert-QCocoaDrag-avoid-using-the-deprecated-API-if-.patch b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/macos-sdk-10.12/0004-Revert-QCocoaDrag-avoid-using-the-deprecated-API-if-.patch
index 7b568a91943f9..ee9b80ca6ed4d 100644
--- a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/macos-sdk-10.12/0004-Revert-QCocoaDrag-avoid-using-the-deprecated-API-if-.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/macos-sdk-10.12/0004-Revert-QCocoaDrag-avoid-using-the-deprecated-API-if-.patch
@@ -175,14 +175,16 @@ index 978d73f7d9..463e3c5579 100644
      QPoint windowPoint = QPointF::fromCGPoint([self convertPoint:sender.draggingLocation fromView:nil]).toPoint();
  
      qCDebug(lcQpaMouse) << QEvent::DragLeave << self << "at" << windowPoint;
-@@ -294,10 +290,7 @@ static QPoint mapWindowCoordinates(QWindow *source, QWindow *target, QPoint poin
+@@ -294,12 +294,7 @@ static QPoint mapWindowCoordinates(QWindow *source, QWindow *target, QPoint poin
      if (!target)
          return;
  
 -    QCocoaDrag* nativeDrag = QCocoaIntegration::instance()->drag();
 -    Q_ASSERT(nativeDrag);
 -    nativeDrag->exitDragLoop();
--    nativeDrag->setAcceptedAction(qt_mac_mapNSDragOperation(operation));
+-    // for internal drag'n'drop, don't override the action the drop event accepted
+-    if (!nativeDrag->currentDrag())
+-        nativeDrag->setAcceptedAction(qt_mac_mapNSDragOperation(operation));
 +    QCocoaIntegration::instance()->drag();
  
      // Qt starts drag-and-drop on a mouse button press event. Cococa in
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index b772331fc3db7..37685b07d3440 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,118 +1,118 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "6d926ec2739f2289c6b0bbfbc325700046e1ceee",
-    "sha256": "1w2m1rm6mhj9qbanak36rqvc30x495zvj7mh2syy1yd29by0g5i8"
+    "rev": "3cc801c4ae41ff3f155258c4bf7e21bb5b3f6a3d",
+    "sha256": "0ia17cn59100n4qkxc1bdn36knqpdqy1dx06la4qlhvm6hzb7wpj"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "2c53a16f431bbb950bfca8ac32ddabf217a0bf04",
-    "sha256": "0llk76lf0mh4mzj7pwd8cs55wpmfq8v1bsdzvizb1sx0vfbjh8g6"
+    "rev": "a4211b21b09a1b98020522bc058e0ee2d6ed2e1d",
+    "sha256": "1gdnqhx75iwja50nhvdb8fxbdcpw18pc6xpd105kj4j62f73j1hq"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "1939eada1cdf00052bba32657d9d975c1e255128",
-    "sha256": "130a1yda2m7pa10as3rccz84m3617422n6s51pdn4kp8p8rk7cs6"
+    "rev": "45ce7b075b5dd19744b9446aa9e8ceb1d099d8b9",
+    "sha256": "15b7258mjdxbqpgr9bjhysagznnx97l2948c15xjpb77sc8l0wlh"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "ee7a89b2c4750bc3cabe4aeb466645d6ac2a872b",
-    "sha256": "10aj4nxfpx34k0if2kl5sxfjpk3sb1r9z7p6haypjpw60cssjbsl"
+    "rev": "aa0c6db334cf6f0887f42cbd82e4af258126bdc5",
+    "sha256": "0gxlqkag06fd7jbk7kjcjxxa3wxm27fa9vdd4hzq5gkq5y1hslaw"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "f13988aa1ad9de5d92e7b0ba4d0d947dd019d759",
-    "sha256": "1l7zmdkakc7bc9c10nzijg86ps9f3jpi1nblkfxr6521g0xjrmb8"
+    "rev": "9a569795f0c3f41ec093e4aa5842a463e2755edb",
+    "sha256": "12w48q59xcr0l1s941pnsp5s8xk5knis9c1cry6kvybiq51hl77n"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "aa2def2bdb76f8fd2454dc4515883fd7b5ddb521",
-    "sha256": "1fy4anhj432fz05kinb67v8ckdp9h7150fhy4dm6hgbjq6y7j16g"
+    "rev": "42c25efeaa409f711af1bd9a8144b445741ee114",
+    "sha256": "0bj28j5ksr95bj9vmqcahvx3a5bc8kd9kkd6q8nsg7ak0bm0cm2p"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "19af9584f7b80928ee49950c573c770af68c9519",
-    "sha256": "0xya1m2csb42yisl90s9822p9q92n7ags909nlbapfsb49qwsqnj"
+    "rev": "a32c95d27224c6c9e41d6080ea54bc937c5d1455",
+    "sha256": "105cdvz8y48lhyn1s5w8ckcd0vk2gq7aqnmndiq45k1c8nikn2ry"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "02105099301450c890e1caba977ef44efdc43da7",
-    "sha256": "0wk8a9fbjwrqwb4gj5s78ipg1svdrhz80cykjd6qgkd26dh1p4kn"
+    "rev": "c47f3d7b227c9bc86ca1702ae3291a62c2116cfa",
+    "sha256": "0izk3zxbf1h1k88qvq8p6yaza9pkm19w4f491mbazs87qwfh3dni"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "ed002122ce74b3505ba55262ddbc842a810e8159",
-    "sha256": "03hb1jgx49rh5gldxq7d85s1ny0yl64nylw7d61dvsgbs422fqn9"
+    "rev": "a2a7f0f219ccedf1ecb2bc06760ef5439262aacd",
+    "sha256": "1s2jbwq83zfqg7d0mq4v60nvpg4zfa47xqgh7sglgk1s922jyj76"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "6b7a6303439f83147680723f4d8142d676cdb928",
-    "sha256": "1h9yb0asprynnb2qyjbmyglrkk9f9v19g6zzpk0gmixrp0h8gk46"
+    "rev": "5107ddf28177112cdbf505f92bb4191a91e6521a",
+    "sha256": "1fyyyljhl8h4rgik3i8gi2xg5r05xd2vf4qgn4ybf3yafjsra9am"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "379577925766385991f413a2b0d0d46831381ffa",
-    "sha256": "0x11n2fym765z3gyb4xnfl7v6zrip1wjkkl6nx1bxaya173fvdw8"
+    "rev": "c25898224cd957491d10dbe48f2f0be66f2955de",
+    "sha256": "1cr3hykl79yr7x06hjfx9g6nq2wmb3q5hszby83hbzpf166h8zjf"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "90038c936763645610fe1e5f05cfc025e4d98631",
-    "sha256": "1yqfz58p7s92jr8d4lk4n0dv6ij8fslh4sxdz0azd0p6077rim77"
+    "rev": "0ee52083683c9fcd996118ef62d9e60b5431a520",
+    "sha256": "0ainvxp2sw13dx44j8waa89bni8ylxkykr6mwncsspi7da9dqxq2"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "e07f35879536640ad784e71e5261c5a597d504f5",
-    "sha256": "1yhwaz2wyq2hx9bqrcimabj9jbv2kr9h0czxxryh5b9b6aim6ncw"
+    "rev": "73db91329ae48f685fa3fdae1c3c63b0976dc751",
+    "sha256": "0l8amd9fsn8agxgvxmij59i12504bmzbvyc1rz6nqhcpib4z5w7l"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "fca3f80f0ce389271e5bd9af864ce56a313d359a",
-    "sha256": "1xgykaw8qjnaip6h9jx0nfadc9amb6aclk758vm5pp43dvs5j96r"
+    "rev": "4b3d1e824fdde2c835041464a9f85feaed0b313d",
+    "sha256": "02g7znswwki86723d3p23n0hwdi6brch9whx526l92sfx308z380"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "80bc8d86508579c7a57110c09a44e33f9d8bc0e5",
-    "sha256": "1n9qixhgz66frsp56cr7zzaxcns3ijip46pa9zcz3m0f438n08z7"
+    "rev": "166cb4d6166cab60a66a074c848f6ed725e6755c",
+    "sha256": "09f34v5x4z3y58z6b4hriqclrf9mjncxyl4h9ph0cicam66575ms"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "fa6c3d653682f9fd331d859c7196a291a8a4d8d5",
-    "sha256": "0x4112b93dryfgy6w49z3jqd8xi8pvc3xqfn2j0n0qhdp4vvz5sl"
+    "rev": "16d9ea642bf7b9592a6c53321cc7ee9d9a3ed03f",
+    "sha256": "1xi2shsg0apk7rk7ccrbnjsg9j6p8svgs1pbml48ci57i36dgzfv"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "958db00a2064f77b354b573102ca2c2b2e07529c",
-    "sha256": "0idaysqpwrghih7ijrm9hagj9jw3fy9nw539fr4d9rmcggnkkzn2"
+    "rev": "9e698881cb07ebf04319f5cfa7b065c8bc2c1afb",
+    "sha256": "0207z0mv6nfgw7vhh43sx7r8z4cmvilh31x1x24d7nxj9rggnm1b"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "255b9e16f286003bbfaff9d48e4548fb0cb3b398",
-    "sha256": "1cki7n62wqm3xxn36mka0y67ngn7jvjkrvr08vsassbjb7kfsmxp"
+    "rev": "87021fd1e50f0aa3589a2412cfa665a6d27cc740",
+    "sha256": "184mpjc0vnrmxl7z0x2c1xj2adrdx12l5swpzh51q1wb45j1lvna"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "1ede2ac20170357b3e8d7d9810e5474e08170827",
-    "sha256": "1sxlyv1y6aanln7cv1m8fgjkp72lgx2k4q8a23m79g7xryl0xx2a"
+    "rev": "1a8736a5834492aa8b7fc2dbc59a1eb4420a7330",
+    "sha256": "1byn9g46jd4krij0h1x7lfn7ac5v4rican0lppngm065is4c6c7p"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "d054de15b3c9ead0f96655ddfb1a6381ed7a0e2b",
-    "sha256": "0inym59pnr6pk9y4im2fsq1hzs8b4rwqs3x6cgc61z3kqyv74cb6"
+    "rev": "4fb4e5942bfa1f92f1c759f182aa504ad52e8e3b",
+    "sha256": "1qkamv5p97p0lp7968cdjz4ah8mfqmrq23dikqvkwnirl3bffd83"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "26bd7f5414dc592ab5277e2bb4ad0199faa889de",
-    "sha256": "0d53d1fqcc7ccd9ljr3q1qxd7k7kkn6msqa81592pg6b4ridzdsq"
+    "rev": "59cc1cc5b3719713598a1f426d82a9d895b5dccb",
+    "sha256": "0i1k520080h0q85hifs5axnn4dysmvwhrsm0kxq28qgdpqjzkli6"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "98b1ff53458887061b4bcc183efcce899f432394",
-    "sha256": "1q4d88cym0c5vmw40qjp968x5sp7dx4mq6cr1r6px9i0ifvimdrg"
+    "rev": "2da3c0efd5016bdba26b80789773238c2886fdf6",
+    "sha256": "0lmyw4cxgj5kcisd2pbcpl1zynj2rfa3nsfl1n2mcz6ca650ibys"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "581475dfeb44c8b51c0be86e0f2f57df7d117a80",
-    "sha256": "1zbxl5jk7x8qklrnbbaikymyviigqdq7vf0wc8gzls4126vcx146"
+    "rev": "89407ff20e4f76314887e2f3625f5126910031ac",
+    "sha256": "1qimf60hz1962l5wpdh33y6xz3h8zcnf5yj5b1i0gfyzg0c2ki5n"
   },
   "qtscript": {
     "url": "https://invent.kde.org/qt/qt/qtscript.git",
@@ -121,87 +121,87 @@
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "50d2da3965ed8e85f3f5f5760393c42b12d34a9f",
-    "sha256": "148qdyw084agpp4n31cfcgk39ppwf9ndifnvihd94c6ksf1ax3ks"
+    "rev": "bb5d10f926c51aa462a56ffb331afd4f9607855c",
+    "sha256": "0wkwkzfv5hxkhrpmy0knlxf9c7qkals5s9c0bw71k9dz8n24d7j8"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "975ba788d3d0ee87aa08bb5301cd33dcbf00521b",
-    "sha256": "13x0d0ky5dybp1lq39yy82xg7hxdvmksam8r85gqargsi0zr5s8x"
+    "rev": "bce4b6231229e953c3961f3d9858e58555a55d56",
+    "sha256": "15b2scai53d10c8bv6kv4k9lc3z9bixr4364yw2pkm71mwir90ga"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "22b3cad193232ab379a0c9e16989a7db1fdc9234",
-    "sha256": "1j084szvdmfxbc9n37phxsd7k4vxd073vwy1hcnjhmpyg9hwrw81"
+    "rev": "b6e22f07fb529736c9362d81de7f5c632bd1f439",
+    "sha256": "039kd0yk1am9s1yr39p7gwirjl3126arqf9r01xn5kcs4viizh1k"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "f95e2411d7c978def87846ea7cedf3dc5fd7c8b8",
-    "sha256": "0x7ly67gddmz0hqls9109bk4rgaa97ksyv24qk4brrhzkpr7q9cx"
+    "rev": "112fcd80658a52e6a2822ec79a7d724d0ad003cf",
+    "sha256": "1px0mm301401ha0qx5blhmcmbb17bd71q1smcdlxnl8a704n4nry"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "08b27c29aadc0cc0303cca97c9a3baa2a690dfe4",
-    "sha256": "0lm6i85d7zav43lsrxnhdqcq68np32s3widla8z6c208q1pf3qs6"
+    "rev": "e76b23ad707077647cdb4282cf35a71776efa0f0",
+    "sha256": "0lnvbcx5rflx50wpbhxy7f15ax7cs4l7h44i8y9bb04njqswh0pa"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "2f42157cabbd1db6249ccb1d14e6eede80451e0c",
-    "sha256": "1ldizgybl4fp95xlzf103hqmsqdmr3jbx048jyxcb5gjd3pbwh7p"
+    "rev": "68de925ddc20dfb8900be4fa47fa5a5916836cc8",
+    "sha256": "0b0d70w2ycxac81dqd1yhswcn37055ra3jfqn5srk8wsbdhpjl1c"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "a3e5b2eb8ef5982bc1fffb390ebcd141be1deee4",
-    "sha256": "1x7vzqvc80k0fanvahibmglcv4za07hfiamp26wkhmk0g634ms2q"
+    "rev": "672ba9d902be3634a9fef80be65227aece9e0aed",
+    "sha256": "05rzr6hlipzcm0vs9k721y25hzhv916hv48gr0pbrfzljyvp2yhx"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "a6d5e7f84a57394db4c8b069f81c56cfeb802e19",
-    "sha256": "06r2jb2fsdr5fvxs748war0lr4mm3l3d3b37xc4n73y294vwrmn7"
+    "rev": "0e92fc4f19928387c341533ef3d259efaa752c0f",
+    "sha256": "0vwkf72gpn42g54lhcbgaxbx9awpzi4a0602yhssad0v3a6zrl11"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "bb40dee811333929dd467a480dce24ab7af84ef9",
-    "sha256": "0w6li1qwm2x4plzixd1dv6s1jvcmyrbaw328sri2cmiswajhywdw"
+    "rev": "766c1b7acbdc9ff4e35f6eb341fd446b1c20b811",
+    "sha256": "0bdg98h5z0lwl61860iam6ixcvgis996qj8as739wn9y6k2sv904"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "118674630cdb5933e66a8b4415afe7c716ad4662",
-    "sha256": "1zvx11z0cfv2avj211zsh79806m6mdkk3kczwhcd98k1qs9r9d3p"
+    "rev": "64fa557eb30fc1219bec50a45107ea1a983411ed",
+    "sha256": "14p20mv2dwc3i0qhssl7sqa0bnk14mg0kaq7ai65fqkx5b8qn5xr"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "611016a49f3a9ba7b58bef29bc295323e06373ae",
-    "sha256": "0mggqa8kixknbm1p5i5lkrmkj1na3b2xflj011dkjbj8wb78i42n"
+    "rev": "da9b7b0e059447dceb828bc02d40e30d26b012f2",
+    "sha256": "0kyzzz17d7s9ln6j4ply6hl3y8wky5wslpabbmwsy2952g1y3l99"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "4318ad91c2a8bea3a0aaaa64aaf49d3b997e50a1",
-    "sha256": "0p1y0b8zsm7rrkhhylndp282ghgki2cjrgc4n5zhjn732ahxg515"
+    "rev": "8feafc4b8e9af78175e2814523ef4f11e445fc93",
+    "sha256": "0ck9091bhgvhnwilfjrk9pjlf184bmhia9b92av0sg0m7yrg5wqd"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "7196d2cc34adf9f45b50a9488f4ff95b36092993",
-    "sha256": "1a7n5i4s6nsb19z4r3m3w7gadjpp0irm77ysk61axqjda4ypi7fw"
+    "rev": "e5be9ba432929049da8f4788400c170bf71672da",
+    "sha256": "1jq11rhd0k880gabh839gs474psfc0j20sy65l1l7w1cffwi1zk2"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "ec4de0cec2299f4ae0228ea2c71011e0520ca40e",
-    "sha256": "1na9xv2q4wwy10bcr7684i59d9a20n6s91m12n49yjgrhpn4f4jv"
+    "rev": "429096eb954672d3727a3e8cc83832bc79cf7967",
+    "sha256": "0c0q3dcxz00y8wml141xk3lx91mzg4mg5qlka2k1j49cn1az6lx3"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "051202df9c553d7c0a384f07bd67fde98f3b02c4",
-    "sha256": "0d8y4x41slqjr3nflb14ah1wl2hrlir7331ch9k1qfrk3798a760"
+    "rev": "b41efc2b32a19da9fe369e243dcf3a2a31f7cde6",
+    "sha256": "1prsv3z51sbq9q8v1xj4v312hai6ampdcfnik28rdh7c9mpnq99m"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "f628d7a60e45d90a439cb0a393a6229ac6892be5",
-    "sha256": "04rp8arml19b03iybd7sa78dsdv7386m9ymmgqciwl13dhwjssra"
+    "rev": "0dfaf36ec6f642a0fd583ce1cc33a31eb6b3328e",
+    "sha256": "13fzpipgvlxs9qw128hpnaxr8j4xi8v2fmyy39y1ghf66sfln1zn"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "af4958af9d628d6124e64abd9743abce42f15a6f",
-    "sha256": "0vs9j2i1dnlivcrzz175zz66ql1m8mrdqkglvyqjqv6cb7mpskrq"
+    "rev": "a8edba5ad50d669aead4ddb769f171cba892d676",
+    "sha256": "1342b7qljjqpiq3xjwy0vblq8wqcqyp9s3751ja40n7ishhxd2yj"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 7cba1ae63f96f..5ca0338161811 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,7 +1,7 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.3";
+  version = "5.15.5";
   overrides = {
     qtscript.version = "5.15.4";
   };
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index ba5f959ea4412..9978f6114563d 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -195,7 +195,10 @@ stdenv.mkDerivation {
       # ignore "is only available on macOS 10.12.2 or newer" in obj-c code
       "-Wno-error=unguarded-availability"
     ]
-    ++ lib.optionals withGtk3 [
+    ++ lib.optionals ((compareVersion "5.15.0" >= 0) && stdenv.isDarwin) [
+      # .moc/moc_qprintdialog.cpp:96:31: error: no member named '_q_togglePageSetCombo' in 'QPrintDialogPrivate'
+      "-DQ_OS_MAC"
+    ] ++ lib.optionals withGtk3 [
          ''-DNIXPKGS_QGTK3_XDG_DATA_DIRS="${gtk3}/share/gsettings-schemas/${gtk3.name}"''
          ''-DNIXPKGS_QGTK3_GIO_EXTRA_MODULES="${dconf.lib}/lib/gio/modules"''
        ]
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index 918626d04c9de..3d3193f7e1081 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -23,7 +23,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DUNSAFE_TREAT_WARNINGS_AS_ERRORS=OFF" # disable -Werror
   ] ++ lib.optionals stdenv.hostPlatform.isMips64 [
     # See https://github.com/aws/s2n-tls/issues/1592 and https://github.com/aws/s2n-tls/pull/1609
diff --git a/pkgs/development/libraries/science/biology/bpp-core/default.nix b/pkgs/development/libraries/science/biology/bpp-core/default.nix
index d1eb096e08e61..102cae24adb94 100644
--- a/pkgs/development/libraries/science/biology/bpp-core/default.nix
+++ b/pkgs/development/libraries/science/biology/bpp-core/default.nix
@@ -12,10 +12,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  preCheck = ''
-    export LD_LIBRARY_PATH=$(pwd)/src
-  '';
-
   postFixup = ''
     substituteInPlace $out/lib/cmake/bpp-core/bpp-core-targets.cmake  \
       --replace 'set(_IMPORT_PREFIX' '#set(_IMPORT_PREFIX'
diff --git a/pkgs/development/libraries/science/biology/bpp-phyl/default.nix b/pkgs/development/libraries/science/biology/bpp-phyl/default.nix
index 8ff6ad433fb51..c11b49aa57eb3 100644
--- a/pkgs/development/libraries/science/biology/bpp-phyl/default.nix
+++ b/pkgs/development/libraries/science/biology/bpp-phyl/default.nix
@@ -15,10 +15,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ bpp-core bpp-seq ];
 
-  preCheck = ''
-    export LD_LIBRARY_PATH=$(pwd)/src
-  '';
-
   postFixup = ''
     substituteInPlace $out/lib/cmake/${pname}/${pname}-targets.cmake  \
       --replace 'set(_IMPORT_PREFIX' '#set(_IMPORT_PREFIX'
diff --git a/pkgs/development/libraries/science/biology/bpp-popgen/default.nix b/pkgs/development/libraries/science/biology/bpp-popgen/default.nix
index af5d1d00d4d91..4b9a62eb762bc 100644
--- a/pkgs/development/libraries/science/biology/bpp-popgen/default.nix
+++ b/pkgs/development/libraries/science/biology/bpp-popgen/default.nix
@@ -15,10 +15,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ bpp-core bpp-seq ];
 
-  preCheck = ''
-    export LD_LIBRARY_PATH=$(pwd)/src
-  '';
-
   postFixup = ''
     substituteInPlace $out/lib/cmake/${pname}/${pname}-targets.cmake  \
       --replace 'set(_IMPORT_PREFIX' '#set(_IMPORT_PREFIX'
diff --git a/pkgs/development/libraries/science/biology/bpp-seq/default.nix b/pkgs/development/libraries/science/biology/bpp-seq/default.nix
index ef3f3d5756e90..7981fb28ac098 100644
--- a/pkgs/development/libraries/science/biology/bpp-seq/default.nix
+++ b/pkgs/development/libraries/science/biology/bpp-seq/default.nix
@@ -15,10 +15,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ bpp-core ];
 
-  preCheck = ''
-    export LD_LIBRARY_PATH=$(pwd)/src
-  '';
-
   postFixup = ''
     substituteInPlace $out/lib/cmake/${pname}/${pname}-targets.cmake  \
       --replace 'set(_IMPORT_PREFIX' '#set(_IMPORT_PREFIX'
diff --git a/pkgs/development/libraries/science/biology/elastix/default.nix b/pkgs/development/libraries/science/biology/elastix/default.nix
index 15465c501b43f..84762414fef93 100644
--- a/pkgs/development/libraries/science/biology/elastix/default.nix
+++ b/pkgs/development/libraries/science/biology/elastix/default.nix
@@ -24,10 +24,6 @@ stdenv.mkDerivation rec {
 
   doCheck = !stdenv.isDarwin;  # usual dynamic linker issues
 
-  preCheck = "
-    export LD_LIBRARY_PATH=$(pwd)/bin
-  ";
-
   meta = with lib; {
     homepage = "https://elastix.lumc.nl";
     description = "Image registration toolkit based on ITK";
diff --git a/pkgs/development/libraries/science/math/arpack/default.nix b/pkgs/development/libraries/science/math/arpack/default.nix
index 88336f21ed27b..9d96368a4cda7 100644
--- a/pkgs/development/libraries/science/math/arpack/default.nix
+++ b/pkgs/development/libraries/science/math/arpack/default.nix
@@ -36,11 +36,7 @@ stdenv.mkDerivation rec {
     "-DINTERFACE64=${if blas.isILP64 then "1" else "0"}"
   ];
 
-  preCheck = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}`pwd`/lib:${blas}/lib:${lapack}/lib
-  '' else ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}`pwd`/lib
-  '' + ''
+  preCheck = ''
     # Prevent tests from using all cores
     export OMP_NUM_THREADS=2
   '';
diff --git a/pkgs/development/libraries/science/math/itpp/default.nix b/pkgs/development/libraries/science/math/itpp/default.nix
index b2acbe761b3bc..c3ff2aeebfb40 100644
--- a/pkgs/development/libraries/science/math/itpp/default.nix
+++ b/pkgs/development/libraries/science/math/itpp/default.nix
@@ -39,8 +39,6 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   checkPhase = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/itpp
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD/itpp
     ./gtests/itpp_gtests
   '';
 
diff --git a/pkgs/development/libraries/science/math/metis/default.nix b/pkgs/development/libraries/science/math/metis/default.nix
index 41deec25d454e..cd221e86b1486 100644
--- a/pkgs/development/libraries/science/math/metis/default.nix
+++ b/pkgs/development/libraries/science/math/metis/default.nix
@@ -9,7 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "1cjxgh41r8k6j029yxs8msp3z6lcnpm16g5pvckk35kc7zhfpykn";
   };
 
-  cmakeFlags = [ "-DGKLIB_PATH=../GKlib" ];
+  cmakeFlags = [
+    "-DGKLIB_PATH=../GKlib"
+    # remove once updated past https://github.com/KarypisLab/METIS/commit/521a2c360dc21ace5c4feb6dc0b7992433e3cb0f
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
   nativeBuildInputs = [ unzip cmake ];
 
   meta = {
diff --git a/pkgs/development/libraries/science/math/scalapack/default.nix b/pkgs/development/libraries/science/math/scalapack/default.nix
index 7620844f8d1cd..ebf167de8d9d6 100644
--- a/pkgs/development/libraries/science/math/scalapack/default.nix
+++ b/pkgs/development/libraries/science/math/scalapack/default.nix
@@ -67,8 +67,6 @@ stdenv.mkDerivation rec {
 
     # Run single threaded
     export OMP_NUM_THREADS=1
-
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}`pwd`/lib
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 9255889c6943c..a29706aefc483 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -35,11 +35,6 @@ stdenv.mkDerivation rec {
     sed -e '/freetype freetype.c/d' -i ../tests/examples/CMakeLists.txt
   '';
 
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/src/
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD/src/
-  '';
-
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/snappy/default.nix b/pkgs/development/libraries/snappy/default.nix
index 797db5b69b0c3..7d70c500dfac0 100644
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DSNAPPY_BUILD_TESTS=OFF"
     "-DSNAPPY_BUILD_BENCHMARKS=OFF"
   ];
diff --git a/pkgs/development/libraries/spdlog/default.nix b/pkgs/development/libraries/spdlog/default.nix
index 5a21af12e33ca..523fe798168cb 100644
--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@@ -36,11 +36,6 @@ let
       '';
 
       doCheck = true;
-      preCheck =  if stdenv.isDarwin then ''
-        export DYLD_LIBRARY_PATH="$(pwd)''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
-      '' else ''
-        export LD_LIBRARY_PATH="$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-      '';
 
       meta = with lib; {
         description    = "Very fast, header only, C++ logging library";
diff --git a/pkgs/development/libraries/utf8proc/default.nix b/pkgs/development/libraries/utf8proc/default.nix
index ec8dab3f90c76..7e3471eefa016 100644
--- a/pkgs/development/libraries/utf8proc/default.nix
+++ b/pkgs/development/libraries/utf8proc/default.nix
@@ -16,7 +16,6 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
     "-DUTF8PROC_ENABLE_TESTING=ON"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index eb58e0d54fdb5..43c6ded8a5d02 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -53,10 +53,6 @@ in stdenv.mkDerivation rec {
 
   patches = map fetchpatch patchesToFetch;
 
-  preBuild = ''
-    export LD_LIBRARY_PATH="$(pwd)/lib";
-  '';
-
   dontWrapQtApps = true;
 
   # Shared libraries don't work, because of rpath troubles with the current
diff --git a/pkgs/development/libraries/wayland/0001-add-placeholder-for-nm.patch b/pkgs/development/libraries/wayland/0001-add-placeholder-for-nm.patch
deleted file mode 100644
index f6745e6f94333..0000000000000
--- a/pkgs/development/libraries/wayland/0001-add-placeholder-for-nm.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 378623b0e39b12bb04d3a3a1e08e64b31bd7d99d Mon Sep 17 00:00:00 2001
-From: Florian Klink <flokli@flokli.de>
-Date: Fri, 27 Nov 2020 10:22:20 +0100
-Subject: [PATCH] add placeholder for @nm@
-
----
- egl/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/egl/meson.build b/egl/meson.build
-index dee9b1d..e477546 100644
---- a/egl/meson.build
-+++ b/egl/meson.build
-@@ -11,7 +11,7 @@ wayland_egl = library(
- 
- executable('wayland-egl-abi-check', 'wayland-egl-abi-check.c')
- 
--nm_path = find_program('nm').path()
-+nm_path = find_program('@nm@').path()
- 
- test(
- 	'wayland-egl symbols check',
--- 
-2.29.2
-
diff --git a/pkgs/development/libraries/wayland/add-placeholder-for-nm.patch b/pkgs/development/libraries/wayland/add-placeholder-for-nm.patch
new file mode 100644
index 0000000000000..dbc63028b45b1
--- /dev/null
+++ b/pkgs/development/libraries/wayland/add-placeholder-for-nm.patch
@@ -0,0 +1,13 @@
+diff --git a/egl/meson.build b/egl/meson.build
+index b3cbdf3..cdc15ca 100644
+--- a/egl/meson.build
++++ b/egl/meson.build
+@@ -11,7 +11,7 @@ wayland_egl = library(
+
+ executable('wayland-egl-abi-check', 'wayland-egl-abi-check.c')
+
+-nm_path = find_program('nm').full_path()
++nm_path = find_program('@nm@').full_path()
+
+ test(
+        'wayland-egl symbols check',
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index ee897d64142ca..ac434b795aef5 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , substituteAll
 , meson
 , pkg-config
@@ -30,16 +29,16 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wayland";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchurl {
-    url = "https://wayland.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "09c7rpbwavjg4y16mrfa57gk5ix6rnzpvlnv1wp7fnbh9hak985q";
+    url = "https://gitlab.freedesktop.org/wayland/wayland/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
+    sha256 = "1b0ixya9bfw5c9jx8mzlr7yqnlyvd3jv5z8wln9scdv8q5zlvikd";
   };
 
   patches = [
     (substituteAll {
-      src = ./0001-add-placeholder-for-nm.patch;
+      src = ./add-placeholder-for-nm.patch;
       nm = "${stdenv.cc.targetPrefix}nm";
     })
   ];
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 61696d232f794..5fca71ebf0c19 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wayland-protocols";
-  version = "1.25";
+  version = "1.26";
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
   src = fetchurl {
     url = "https://wayland.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "0q0laxdvf8p8b7ks2cbpqf6q0rwrjycqrp8pf8rxm86hk5qhzzzi";
+    sha256 = "04vgllmpmrv14x3x64ns01vgwx4hriljayjkz9idgbv83i63hly5";
   };
 
   postPatch = lib.optionalString doCheck ''
diff --git a/pkgs/development/libraries/yder/default.nix b/pkgs/development/libraries/yder/default.nix
index 9dd55482300cf..b5667f9cfe6a6 100644
--- a/pkgs/development/libraries/yder/default.nix
+++ b/pkgs/development/libraries/yder/default.nix
@@ -39,11 +39,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  preCheck = ''
-    export LD_LIBRARY_PATH="$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-    export DYLD_FALLBACK_LIBRARY_PATH="$(pwd):$DYLD_FALLBACK_LIBRARY_PATH"
-  '';
-
   meta = with lib; {
     description = "Logging library for C applications";
     homepage = "https://github.com/babelouest/yder";
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index 815c609428acd..c620761dde255 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "3.2.13";
+  version = "3.2.14";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Django";
     inherit version;
-    sha256 = "sha256-bZNJegqb9roOCxopzM3EDvv8dilyVbEwmzqISmiOxLY=";
+    sha256 = "sha256-Z3GCuotbKFpOBy86wXzu5q/xtc53/Rc8xbai09wCL88=";
   };
 
   patches = lib.optional withGdal
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 8dc627b68790c..db81511da99d0 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -39,14 +39,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.0.5";
+  version = "4.0.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-90MaXecneWbzeFVXw5KEMzR9mYweZFkyRQE3iikeWqs=";
+    hash = "sha256-pnp5P/aCf9NzVVU33KDaKTpjoxb+NMt/Nn+JjMyjw64=";
   };
 
   patches = lib.optional withGdal
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 794d504337e23..52a95fd8b65ff 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.46.3";
+  version = "1.47.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "78442ac7d2813c56f9cc04f713efd7088596b10f88a4ddd09279211cc48402d5";
+    sha256 = "c9ce3213e84c6fd8801c31aca3ea4a6b3453eaa40b93a6c0a23ea8999808fa00";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index c80bc6f9bf6a8..73a98008739bb 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.46.3";
+  version = "1.47.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "31fee436ace5b3bd950cc3a8e68d6b84de1d6dc755959db7badc3470cdf22f70";
+    sha256 = "f64b5378484be1d6ce59311f86174be29c8ff98d8d90f589e1c56d5acae67d3c";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index a061f53b6ca37..017069a7dd2d4 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchpatch
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
@@ -13,24 +12,16 @@
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "9.1.1";
+  version = "9.2.0";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Pillow";
     inherit version;
-    sha256 = "sha256-dQJTmTm1PXVl89Edh8eOfskA08cpRdTuDi8lDVmDCaA=";
+    sha256 = "sha256-deY2/T4PuHJpPyPMuKX/LNV4gBJR86T2hUxqXUN9PAQ=";
   };
 
-  patches = [
-    # Fix failing test with libtiff 4.4.0
-    (fetchpatch {
-      url = "https://github.com/python-pillow/Pillow/commit/40a918d274182b7d7c063d7797fb77d967982c4a.patch";
-      sha256 = "sha256-f8m3Xt3V3pHggK1JEc2tnPmrTVPFjfV4YJqwE1KM1pA=";
-    })
-  ];
-
   passthru.tests = {
     inherit imageio matplotlib pilkit pydicom reportlab;
   };
diff --git a/pkgs/development/python-modules/rdkit/default.nix b/pkgs/development/python-modules/rdkit/default.nix
index f98e4d992a328..4916afc5861aa 100644
--- a/pkgs/development/python-modules/rdkit/default.nix
+++ b/pkgs/development/python-modules/rdkit/default.nix
@@ -133,6 +133,7 @@ buildPythonPackage rec {
     "-DBOOST_ROOT=${boost}"
     "-DBoost_NO_SYSTEM_PATHS=ON"
     "-DBoost_NO_BOOST_CMAKE=TRUE"
+    "-DCMAKE_SKIP_BUILD_RPATH=ON" # fails to find libs in pythonImportsCheckPhase otherwise
   ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/typogrify/default.nix b/pkgs/development/python-modules/typogrify/default.nix
index 25445d8a7d294..81425b22f181e 100644
--- a/pkgs/development/python-modules/typogrify/default.nix
+++ b/pkgs/development/python-modules/typogrify/default.nix
@@ -1,32 +1,33 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPyPy
-, django
 , smartypants
-, jinja2
 }:
 
 buildPythonPackage rec {
   pname = "typogrify";
   version = "2.0.7";
-  disabled = isPyPy;
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "8be4668cda434163ce229d87ca273a11922cb1614cb359970b7dc96eed13cb38";
   };
 
-  propagatedBuildInputs = [ django smartypants jinja2 ];
+  propagatedBuildInputs = [
+    smartypants
+  ];
 
   # Wants to set up Django
   doCheck = false;
 
+  pythonImportsCheck = [ "typogrify.filters" ];
+
   meta = with lib; {
     description = "Filters to enhance web typography, including support for Django & Jinja templates";
     homepage = "https://github.com/mintchaos/typogrify";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
-
 }
diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index ec7f3e47ca737..c3b637da0670e 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -6,7 +6,7 @@
 , libuv
 , CoreServices
 , ApplicationServices
-# Check Inputs
+  # Check Inputs
 , aiohttp
 , psutil
 , pyopenssl
@@ -34,7 +34,6 @@ buildPythonPackage rec {
   checkInputs = [
     aiohttp
     pytestCheckHook
-    pyopenssl
     psutil
   ];
 
@@ -46,15 +45,18 @@ buildPythonPackage rec {
     "--assert=plain"
     "--strict"
     "--tb=native"
+    # Depend on pyopenssl
+    "--deselect tests/test_tcp.py::Test_UV_TCPSSL::test_flush_before_shutdown"
+    "--deselect tests/test_tcp.py::Test_UV_TCPSSL::test_renegotiation"
   ] ++ lib.optionals (stdenv.isAarch32 || stdenv.isAarch64) [
     # test gets stuck in epoll_pwait on hydras aarch64 builders
     # https://github.com/MagicStack/uvloop/issues/412
-    "--deselect" "tests/test_tcp.py::Test_AIO_TCPSSL::test_remote_shutdown_receives_trailing_data"
+    "--deselect tests/test_tcp.py::Test_AIO_TCPSSL::test_remote_shutdown_receives_trailing_data"
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # Flaky test: https://github.com/MagicStack/uvloop/issues/412
-    "--deselect" "tests/test_tcp.py::Test_UV_TCPSSL::test_shutdown_timeout_handler_not_set"
+    "--deselect tests/test_tcp.py::Test_UV_TCPSSL::test_shutdown_timeout_handler_not_set"
     # Broken: https://github.com/NixOS/nixpkgs/issues/160904
-    "--deselect" "tests/test_context.py::Test_UV_Context::test_create_ssl_server_manual_connection_lost"
+    "--deselect tests/test_context.py::Test_UV_Context::test_create_ssl_server_manual_connection_lost"
   ];
 
   disabledTestPaths = [
@@ -66,7 +68,11 @@ buildPythonPackage rec {
     # Work around "OSError: AF_UNIX path too long"
     # https://github.com/MagicStack/uvloop/issues/463
     export TMPDIR="/tmp"
-   '' + ''
+  '' + ''
+    # pyopenssl is not well supported by upstream
+    # https://github.com/NixOS/nixpkgs/issues/175875
+    substituteInPlace tests/test_tcp.py \
+      --replace "from OpenSSL import SSL as openssl_ssl" ""
     # force using installed/compiled uvloop vs source by moving tests to temp dir
     export TEST_DIR=$(mktemp -d)
     cp -r tests $TEST_DIR
diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index 7ba8c70a98059..e5f9d045a5b49 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -18,7 +18,7 @@
 # Normal gem packages can be used outside of bundler; a binstub is created in
 # $out/bin.
 
-{ lib, fetchurl, fetchgit, makeWrapper, gitMinimal, darwin
+{ lib, fetchurl, fetchgit, makeWrapper, gitMinimal, libobjc
 , ruby, bundler
 } @ defs:
 
@@ -35,6 +35,7 @@ lib.makeOverridable (
 , namePrefix ? (let
     rubyName = builtins.parseDrvName ruby.name;
   in "${rubyName.name}${rubyName.version}-")
+, nativeBuildInputs ? []
 , buildInputs ? []
 , meta ? {}
 , patches ? []
@@ -87,11 +88,15 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
   inherit dontStrip;
   inherit type;
 
-  buildInputs = [
+  nativeBuildInputs = [
     ruby makeWrapper
   ] ++ lib.optionals (type == "git") [ gitMinimal ]
     ++ lib.optionals (type != "gem") [ bundler ]
-    ++ lib.optional stdenv.isDarwin darwin.libobjc
+    ++ nativeBuildInputs;
+
+  buildInputs = [
+    ruby
+  ] ++ lib.optionals stdenv.isDarwin [ libobjc ]
     ++ buildInputs;
 
   #name = builtins.trace (attrs.name or "no attr.name" ) "${namePrefix}${gemName}-${version}";
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 89e8e0e197a0b..50f23f1bb7b11 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -102,9 +102,8 @@ cmakeConfigurePhase() {
         cmakeFlags="-DBUILD_TESTING=OFF $cmakeFlags"
     fi
 
-    # Avoid cmake resetting the rpath of binaries, on make install
-    # And build always Release, to ensure optimisation flags
-    cmakeFlags="-DCMAKE_BUILD_TYPE=${cmakeBuildType:-Release} -DCMAKE_SKIP_BUILD_RPATH=ON $cmakeFlags"
+    # Always build Release, to ensure optimisation flags
+    cmakeFlags="-DCMAKE_BUILD_TYPE=${cmakeBuildType:-Release} $cmakeFlags"
 
     # Disable user package registry to avoid potential side effects
     # and unecessary attempts to access non-existent home folder
diff --git a/pkgs/development/tools/misc/libtool/default.nix b/pkgs/development/tools/misc/libtool/default.nix
index 79db7e710b063..b9e32372922f5 100644
--- a/pkgs/development/tools/misc/libtool/default.nix
+++ b/pkgs/development/tools/misc/libtool/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
   # "fixed" path in generated files!
   dontPatchShebangs = true;
+  dontFixLibtool = true;
 
   meta = {
     description = "Generic library support script";
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 813cc71938f29..92a230374df65 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -51,6 +51,7 @@ stdenv.mkDerivation rec {
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
   # "fixed" path in generated files!
   dontPatchShebangs = true;
+  dontFixLibtool = true;
 
   # XXX: The GNU ld wrapper does all sorts of nasty things wrt. RPATH, which
   # leads to the failure of a number of tests.
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index f3f29cc1acd6d..9cf752af5b8f0 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -4,7 +4,7 @@ let dialect = with lib; last (splitString "-" stdenv.hostPlatform.system); in
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.94.0";
+  version = "4.95.0";
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ ncurses ];
@@ -13,18 +13,24 @@ stdenv.mkDerivation rec {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    sha256 = "0yxv2jg6rnzys49lyrz9yjb4knamah4xvlqj596y6ix3vm4k3chp";
+    sha256 = "sha256-HgU7/HxLdUOfLU2E/dpusko6gBOoEKeWPJIFbBQGzFU=";
   };
 
   patches = [
     ./no-build-info.patch
 
     # Pull upstream fix for -fno-common toolchains:
-    #   https://github.com/lsof-org/lsof/pull/221
+    #   https://github.com/lsof-org/lsof/pull/226
+    #   https://github.com/lsof-org/lsof/pull/233
     (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/lsof-org/lsof/commit/80e7c890585deec02c527dbcf42bc0e5d8d7c534.patch";
-      sha256 = "17xshi7j7af9nli1zjk1m5f4il2ajvvhw7lii8g8d27rkkgyb8g6";
+      name = "add-extern.patch";
+      url = "https://github.com/lsof-org/lsof/commit/180ffa29b0544f77cabbc54d7f77d50d33dd27d7.patch";
+      sha256 = "sha256-zzcN9HrFYMTBeEekeAwi2RIcVukymgaqtpvFIBV6njU=";
+    })
+    (fetchpatch {
+      name = "add-declaration.patch";
+      url = "https://github.com/lsof-org/lsof/commit/8e47e1491636e8cf41baf834554391be45177b00.patch";
+      sha256 = "sha256-kwkDQp7VApLenOLTPMY24Me+/xUhD56skHWRd4ZB1I4=";
     })
   ];
 
diff --git a/pkgs/development/tools/misc/lsof/no-build-info.patch b/pkgs/development/tools/misc/lsof/no-build-info.patch
index cf785e248f2a9..c433fd6e08f89 100644
--- a/pkgs/development/tools/misc/lsof/no-build-info.patch
+++ b/pkgs/development/tools/misc/lsof/no-build-info.patch
@@ -1,12 +1,9 @@
-diff -ru -x '*~' lsof_4.91_src-orig/usage.c lsof_4.91_src/usage.c
---- lsof_4.91_src-orig/usage.c	2018-02-14 15:20:32.000000000 +0100
-+++ lsof_4.91_src/usage.c	2018-10-08 21:57:45.718560869 +0200
-@@ -930,26 +930,6 @@
+--- a/usage.c	2018-02-14 15:20:32.000000000 +0100
++++ b/usage.c	2018-10-08 21:57:45.718560869 +0200
+@@ -930,24 +930,6 @@
  		(void) fprintf(stderr, "    configuration info: %s\n", cp);
  #endif	/* defined(LSOF_CINFO) */
  
--	    if ((cp = isnullstr(LSOF_CCDATE)))
--		(void) fprintf(stderr, "    constructed: %s\n", cp);
 -	    cp = isnullstr(LSOF_HOST);
 -	    if (!(cp1 = isnullstr(LSOF_LOGNAME)))
 -		cp1 = isnullstr(LSOF_USER);
diff --git a/pkgs/development/tools/misc/sipp/default.nix b/pkgs/development/tools/misc/sipp/default.nix
index 0d5ceba12530c..297669733c0e7 100644
--- a/pkgs/development/tools/misc/sipp/default.nix
+++ b/pkgs/development/tools/misc/sipp/default.nix
@@ -18,6 +18,9 @@ stdenv.mkDerivation rec {
     "-DUSE_PCAP=1"
     "-DUSE_SSL=1"
     "-DUSE_SCTP=${if stdenv.isLinux then "1" else "0"}"
+
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index 04557a27f7409..cc1baad2bb0ef 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -9,6 +9,8 @@ let
   # Fetch clang from qt vendor, this contains submodules like this:
   # clang<-clang-tools-extra<-clazy.
   clang_qt_vendor = llvmPackages_8.clang-unwrapped.overrideAttrs (oldAttrs: {
+    # file RPATH_CHANGE could not write new RPATH
+    cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=ON" ];
     src = fetchgit {
       url = "https://code.qt.io/clang/clang.git";
       rev = "c12b012bb7465299490cf93c2ae90499a5c417d5";
diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index 2064aa0199b4d..49e8fabd45e42 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -157,10 +157,6 @@ let
       touch .git/index .git/modules/library/xml/index
     '';
 
-    preBuild = ''
-      export LD_LIBRARY_PATH="$PWD/depends/protobuf''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-    '';
-
     cmakeFlags = [ "-DDFHACK_BUILD_ARCH=${arch}" "-DDOWNLOAD_RUBY=OFF" ]
       ++ lib.optionals enableStoneSense [ "-DBUILD_STONESENSE=ON" "-DSTONESENSE_INTERNAL_SO=OFF" ];
 
diff --git a/pkgs/games/mudlet/default.nix b/pkgs/games/mudlet/default.nix
index f4ca916aa4997..b2696d7278873 100644
--- a/pkgs/games/mudlet/default.nix
+++ b/pkgs/games/mudlet/default.nix
@@ -62,6 +62,11 @@ stdenv.mkDerivation rec {
     yajl
   ];
 
+  cmakeFlags = [
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   WITH_FONTS = "NO";
   WITH_UPDATER = "NO";
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index d2d21cc9d6cb2..3636b6e3763ce 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -280,9 +280,11 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     objc4           = applePackage "objc4"             "osx-10.12.6"     "1cj1vhbcs9pkmag2ms8wslagicnq9bxi2qjkszmp3ys7z7ccrbwz" {};
     ppp             = applePackage "ppp"               "osx-10.12.6"     "1kcc2nc4x1kf8sz0a23i6nfpvxg381kipi0qdisrp8x9z2gbkxb8" {};
     removefile      = applePackage "removefile"        "osx-10.12.6"     "0jzjxbmxgjzhssqd50z7kq9dlwrv5fsdshh57c0f8mdwcs19bsyx" {};
-    xnu             = applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {
+    xnu             = if stdenv.isx86_64 then
+    applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {
       python3 = pkgs.buildPackages.buildPackages.python3; # TODO(@Ericson2314) this shouldn't be needed.
-    };
+    }
+    else macosPackages_11_0_1.xnu;
     hfs             = applePackage "hfs"               "osx-10.12.6"     "1mj3xvqpq1mgd80b6kl1s04knqnap7hccr0gz8rjphalq14rbl5g" {};
     Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
     adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 90f572d3940d6..8b0d2054d58af 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -4,12 +4,15 @@
 , headersOnly ? true
 }:
 
-appleDerivation' (if headersOnly then stdenvNoCC else stdenv) ({
+appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
+  let arch = if stdenv.isx86_64 then "x86_64" else "arm64";
+  in
+  {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python3 ];
 
-  patches = [ ./python3.patch ];
+  patches = lib.optional stdenv.isx86_64 [ ./python3.patch ];
 
   postPatch = ''
     substituteInPlace Makefile \
@@ -41,9 +44,16 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) ({
       --replace " -o 0" "" \
       --replace '$SRC/$mig' '-I$DSTROOT/include $SRC/$mig' \
       --replace '$SRC/servers/netname.defs' '-I$DSTROOT/include $SRC/servers/netname.defs' \
-      --replace '$BUILT_PRODUCTS_DIR/mig_hdr' '$BUILT_PRODUCTS_DIR'
+      --replace '$BUILT_PRODUCTS_DIR/mig_hdr' '$BUILT_PRODUCTS_DIR' \
+      --replace 'MACHINE_ARCH=armv7' 'MACHINE_ARCH=arm64' # this might break the comments saying 32-bit is required
 
     patchShebangs .
+  '' + lib.optionalString stdenv.isAarch64 ''
+    # iig is closed-sourced, we don't have it
+    # create an empty file to the header instead
+    # this line becomes: echo "" > $@; echo --header ...
+    substituteInPlace iokit/DriverKit/Makefile \
+      --replace '--def $<' '> $@; echo'
   '';
 
   PLATFORM = "MacOSX";
@@ -62,18 +72,22 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) ({
   HOST_BISON = "bison";
   HOST_GM4 = "m4";
   MIGCC = "cc";
-  ARCHS = "x86_64";
+  ARCHS = arch;
+  ARCH_CONFIGS = arch;
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
-  preBuild = ''
+  preBuild = let macosVersion =
+    "10.0 10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 10.9 10.10 10.11" +
+    lib.optionalString stdenv.isAarch64 " 10.12 10.13 10.14 10.15 11.0";
+   in ''
     # This is a bit of a hack...
     mkdir -p sdk/usr/local/libexec
 
     cat > sdk/usr/local/libexec/availability.pl <<EOF
       #!$SHELL
       if [ "\$1" == "--macosx" ]; then
-        echo 10.0 10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 10.9 10.10 10.11
+        echo ${macosVersion}
       elif [ "\$1" == "--ios" ]; then
         echo 2.0 2.1 2.2 3.0 3.1 3.2 4.0 4.1 4.2 4.3 5.0 5.1 6.0 6.1 7.0 8.0 9.0
       fi
@@ -132,7 +146,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) ({
     mv $out/Library/Frameworks/IOKit.framework $out/Library/PrivateFrameworks
   '';
 
-  appleHeaders = builtins.readFile ./headers.txt;
+  appleHeaders = builtins.readFile (./. + "/headers-${arch}.txt");
 } // lib.optionalAttrs headersOnly {
   HOST_CODESIGN = "echo";
   HOST_CODESIGN_ALLOCATE = "echo";
@@ -142,4 +156,5 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) ({
   CTFMERGE = "echo";
   CTFINSERT = "echo";
   NMEDIT = "echo";
+  IIG = "echo";
 })
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt
new file mode 100644
index 0000000000000..fe17d8784e415
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt
@@ -0,0 +1,1486 @@
+AssertMacros.h
+_errno.h
+_libkernel_init.h
+arm/_limits.h
+arm/_mcontext.h
+arm/_param.h
+arm/_types.h
+arm/arch.h
+arm/endian.h
+arm/fasttrap_isa.h
+arm/limits.h
+arm/param.h
+arm/profile.h
+arm/signal.h
+arm/types.h
+arm/vmparam.h
+atm/atm_notification.defs
+atm/atm_types.defs
+atm/atm_types.h
+bank/bank_types.h
+bsd/arm/_limits.h
+bsd/arm/_mcontext.h
+bsd/arm/_param.h
+bsd/arm/_types.h
+bsd/arm/endian.h
+bsd/arm/limits.h
+bsd/arm/param.h
+bsd/arm/profile.h
+bsd/arm/signal.h
+bsd/arm/types.h
+bsd/arm/vmparam.h
+bsd/bsm/audit.h
+bsd/crypto/entropy/diag_entropy_sysctl.h
+bsd/dev/random/randomdev.h
+bsd/libkern/copyio.h
+bsd/libkern/libkern.h
+bsd/machine/_limits.h
+bsd/machine/_mcontext.h
+bsd/machine/_param.h
+bsd/machine/_types.h
+bsd/machine/byte_order.h
+bsd/machine/disklabel.h
+bsd/machine/endian.h
+bsd/machine/limits.h
+bsd/machine/param.h
+bsd/machine/profile.h
+bsd/machine/signal.h
+bsd/machine/types.h
+bsd/machine/vmparam.h
+bsd/miscfs/devfs/devfs.h
+bsd/miscfs/devfs/devfs_proto.h
+bsd/miscfs/devfs/devfsdefs.h
+bsd/miscfs/devfs/fdesc.h
+bsd/miscfs/fifofs/fifo.h
+bsd/miscfs/specfs/specdev.h
+bsd/miscfs/union/union.h
+bsd/net/bpf.h
+bsd/net/dlil.h
+bsd/net/ethernet.h
+bsd/net/if.h
+bsd/net/if_arp.h
+bsd/net/if_dl.h
+bsd/net/if_ether.h
+bsd/net/if_llc.h
+bsd/net/if_media.h
+bsd/net/if_mib.h
+bsd/net/if_types.h
+bsd/net/if_utun.h
+bsd/net/if_var.h
+bsd/net/init.h
+bsd/net/kext_net.h
+bsd/net/kpi_interface.h
+bsd/net/kpi_interfacefilter.h
+bsd/net/kpi_protocol.h
+bsd/net/ndrv.h
+bsd/net/net_kev.h
+bsd/net/pfkeyv2.h
+bsd/net/radix.h
+bsd/net/route.h
+bsd/netinet/bootp.h
+bsd/netinet/icmp6.h
+bsd/netinet/icmp_var.h
+bsd/netinet/if_ether.h
+bsd/netinet/igmp.h
+bsd/netinet/igmp_var.h
+bsd/netinet/in.h
+bsd/netinet/in_arp.h
+bsd/netinet/in_pcb.h
+bsd/netinet/in_systm.h
+bsd/netinet/in_var.h
+bsd/netinet/ip.h
+bsd/netinet/ip6.h
+bsd/netinet/ip_icmp.h
+bsd/netinet/ip_var.h
+bsd/netinet/kpi_ipfilter.h
+bsd/netinet/tcp.h
+bsd/netinet/tcp_fsm.h
+bsd/netinet/tcp_seq.h
+bsd/netinet/tcp_timer.h
+bsd/netinet/tcp_var.h
+bsd/netinet/tcpip.h
+bsd/netinet/udp.h
+bsd/netinet/udp_var.h
+bsd/netinet6/ah.h
+bsd/netinet6/esp.h
+bsd/netinet6/in6.h
+bsd/netinet6/in6_var.h
+bsd/netinet6/ipcomp.h
+bsd/netinet6/ipsec.h
+bsd/netinet6/nd6.h
+bsd/netinet6/raw_ip6.h
+bsd/netinet6/scope6_var.h
+bsd/netkey/keysock.h
+bsd/pthread/bsdthread_private.h
+bsd/pthread/priority_private.h
+bsd/pthread/workqueue_internal.h
+bsd/pthread/workqueue_syscalls.h
+bsd/pthread/workqueue_trace.h
+bsd/security/audit/audit.h
+bsd/security/audit/audit_bsd.h
+bsd/security/audit/audit_ioctl.h
+bsd/security/audit/audit_private.h
+bsd/sys/_endian.h
+bsd/sys/_select.h
+bsd/sys/_structs.h
+bsd/sys/_types.h
+bsd/sys/_types/_blkcnt_t.h
+bsd/sys/_types/_blksize_t.h
+bsd/sys/_types/_caddr_t.h
+bsd/sys/_types/_clock_t.h
+bsd/sys/_types/_ct_rune_t.h
+bsd/sys/_types/_dev_t.h
+bsd/sys/_types/_errno_t.h
+bsd/sys/_types/_fd_clr.h
+bsd/sys/_types/_fd_copy.h
+bsd/sys/_types/_fd_def.h
+bsd/sys/_types/_fd_isset.h
+bsd/sys/_types/_fd_set.h
+bsd/sys/_types/_fd_setsize.h
+bsd/sys/_types/_fd_zero.h
+bsd/sys/_types/_filesec_t.h
+bsd/sys/_types/_fsblkcnt_t.h
+bsd/sys/_types/_fsfilcnt_t.h
+bsd/sys/_types/_fsid_t.h
+bsd/sys/_types/_fsobj_id_t.h
+bsd/sys/_types/_gid_t.h
+bsd/sys/_types/_guid_t.h
+bsd/sys/_types/_id_t.h
+bsd/sys/_types/_in_addr_t.h
+bsd/sys/_types/_in_port_t.h
+bsd/sys/_types/_ino64_t.h
+bsd/sys/_types/_ino_t.h
+bsd/sys/_types/_int16_t.h
+bsd/sys/_types/_int32_t.h
+bsd/sys/_types/_int64_t.h
+bsd/sys/_types/_int8_t.h
+bsd/sys/_types/_intptr_t.h
+bsd/sys/_types/_iovec_t.h
+bsd/sys/_types/_key_t.h
+bsd/sys/_types/_mach_port_t.h
+bsd/sys/_types/_mbstate_t.h
+bsd/sys/_types/_mode_t.h
+bsd/sys/_types/_nlink_t.h
+bsd/sys/_types/_null.h
+bsd/sys/_types/_o_dsync.h
+bsd/sys/_types/_o_sync.h
+bsd/sys/_types/_off_t.h
+bsd/sys/_types/_offsetof.h
+bsd/sys/_types/_os_inline.h
+bsd/sys/_types/_pid_t.h
+bsd/sys/_types/_posix_vdisable.h
+bsd/sys/_types/_ptrdiff_t.h
+bsd/sys/_types/_rsize_t.h
+bsd/sys/_types/_rune_t.h
+bsd/sys/_types/_s_ifmt.h
+bsd/sys/_types/_sa_family_t.h
+bsd/sys/_types/_seek_set.h
+bsd/sys/_types/_sigaltstack.h
+bsd/sys/_types/_sigset_t.h
+bsd/sys/_types/_size_t.h
+bsd/sys/_types/_socklen_t.h
+bsd/sys/_types/_ssize_t.h
+bsd/sys/_types/_suseconds_t.h
+bsd/sys/_types/_time_t.h
+bsd/sys/_types/_timespec.h
+bsd/sys/_types/_timeval.h
+bsd/sys/_types/_timeval32.h
+bsd/sys/_types/_timeval64.h
+bsd/sys/_types/_u_char.h
+bsd/sys/_types/_u_int.h
+bsd/sys/_types/_u_int16_t.h
+bsd/sys/_types/_u_int32_t.h
+bsd/sys/_types/_u_int64_t.h
+bsd/sys/_types/_u_int8_t.h
+bsd/sys/_types/_u_short.h
+bsd/sys/_types/_ucontext.h
+bsd/sys/_types/_ucontext64.h
+bsd/sys/_types/_uid_t.h
+bsd/sys/_types/_uintptr_t.h
+bsd/sys/_types/_useconds_t.h
+bsd/sys/_types/_user32_itimerval.h
+bsd/sys/_types/_user32_ntptimeval.h
+bsd/sys/_types/_user32_timespec.h
+bsd/sys/_types/_user32_timeval.h
+bsd/sys/_types/_user32_timex.h
+bsd/sys/_types/_user64_itimerval.h
+bsd/sys/_types/_user64_ntptimeval.h
+bsd/sys/_types/_user64_timespec.h
+bsd/sys/_types/_user64_timeval.h
+bsd/sys/_types/_user64_timex.h
+bsd/sys/_types/_user_timespec.h
+bsd/sys/_types/_user_timeval.h
+bsd/sys/_types/_uuid_t.h
+bsd/sys/_types/_va_list.h
+bsd/sys/_types/_wchar_t.h
+bsd/sys/_types/_wint_t.h
+bsd/sys/appleapiopts.h
+bsd/sys/attr.h
+bsd/sys/bsdtask_info.h
+bsd/sys/buf.h
+bsd/sys/cdefs.h
+bsd/sys/codesign.h
+bsd/sys/commpage.h
+bsd/sys/conf.h
+bsd/sys/content_protection.h
+bsd/sys/cprotect.h
+bsd/sys/csr.h
+bsd/sys/decmpfs.h
+bsd/sys/dir.h
+bsd/sys/dirent.h
+bsd/sys/disk.h
+bsd/sys/disklabel.h
+bsd/sys/disktab.h
+bsd/sys/dkstat.h
+bsd/sys/doc_tombstone.h
+bsd/sys/domain.h
+bsd/sys/errno.h
+bsd/sys/ev.h
+bsd/sys/event.h
+bsd/sys/eventhandler.h
+bsd/sys/eventvar.h
+bsd/sys/fbt.h
+bsd/sys/fcntl.h
+bsd/sys/file.h
+bsd/sys/file_internal.h
+bsd/sys/filedesc.h
+bsd/sys/fileport.h
+bsd/sys/filio.h
+bsd/sys/fsctl.h
+bsd/sys/fsevents.h
+bsd/sys/fslog.h
+bsd/sys/guarded.h
+bsd/sys/imgact.h
+bsd/sys/ioccom.h
+bsd/sys/ioctl.h
+bsd/sys/ioctl_compat.h
+bsd/sys/ipc.h
+bsd/sys/kasl.h
+bsd/sys/kauth.h
+bsd/sys/kdebug.h
+bsd/sys/kdebug_kernel.h
+bsd/sys/kdebug_private.h
+bsd/sys/kern_control.h
+bsd/sys/kern_event.h
+bsd/sys/kern_memorystatus.h
+bsd/sys/kern_memorystatus_freeze.h
+bsd/sys/kern_memorystatus_notify.h
+bsd/sys/kern_sysctl.h
+bsd/sys/kernel.h
+bsd/sys/kernel_types.h
+bsd/sys/kpi_mbuf.h
+bsd/sys/kpi_private.h
+bsd/sys/kpi_socket.h
+bsd/sys/kpi_socketfilter.h
+bsd/sys/ktrace.h
+bsd/sys/linker_set.h
+bsd/sys/lock.h
+bsd/sys/lockf.h
+bsd/sys/mach_swapon.h
+bsd/sys/malloc.h
+bsd/sys/mbuf.h
+bsd/sys/md5.h
+bsd/sys/memory_maintenance.h
+bsd/sys/mman.h
+bsd/sys/monotonic.h
+bsd/sys/mount.h
+bsd/sys/mount_internal.h
+bsd/sys/msg.h
+bsd/sys/msgbuf.h
+bsd/sys/munge.h
+bsd/sys/namei.h
+bsd/sys/netport.h
+bsd/sys/param.h
+bsd/sys/paths.h
+bsd/sys/persona.h
+bsd/sys/pgo.h
+bsd/sys/pipe.h
+bsd/sys/posix_sem.h
+bsd/sys/posix_shm.h
+bsd/sys/priv.h
+bsd/sys/proc.h
+bsd/sys/proc_info.h
+bsd/sys/proc_internal.h
+bsd/sys/proc_require.h
+bsd/sys/protosw.h
+bsd/sys/pthread_internal.h
+bsd/sys/pthread_shims.h
+bsd/sys/queue.h
+bsd/sys/quota.h
+bsd/sys/random.h
+bsd/sys/reason.h
+bsd/sys/reboot.h
+bsd/sys/resource.h
+bsd/sys/resourcevar.h
+bsd/sys/sbuf.h
+bsd/sys/select.h
+bsd/sys/sem.h
+bsd/sys/sem_internal.h
+bsd/sys/semaphore.h
+bsd/sys/shm.h
+bsd/sys/shm_internal.h
+bsd/sys/signal.h
+bsd/sys/signalvar.h
+bsd/sys/socket.h
+bsd/sys/socketvar.h
+bsd/sys/sockio.h
+bsd/sys/spawn.h
+bsd/sys/spawn_internal.h
+bsd/sys/stackshot.h
+bsd/sys/stat.h
+bsd/sys/stdio.h
+bsd/sys/sys_domain.h
+bsd/sys/syscall.h
+bsd/sys/sysctl.h
+bsd/sys/syslimits.h
+bsd/sys/syslog.h
+bsd/sys/sysproto.h
+bsd/sys/systm.h
+bsd/sys/termios.h
+bsd/sys/time.h
+bsd/sys/timex.h
+bsd/sys/tree.h
+bsd/sys/tty.h
+bsd/sys/ttychars.h
+bsd/sys/ttycom.h
+bsd/sys/ttydefaults.h
+bsd/sys/ttydev.h
+bsd/sys/types.h
+bsd/sys/ubc.h
+bsd/sys/ucontext.h
+bsd/sys/ucred.h
+bsd/sys/uio.h
+bsd/sys/uio_internal.h
+bsd/sys/ulock.h
+bsd/sys/un.h
+bsd/sys/unicode.h
+bsd/sys/unistd.h
+bsd/sys/unpcb.h
+bsd/sys/user.h
+bsd/sys/utfconv.h
+bsd/sys/ux_exception.h
+bsd/sys/vfs_context.h
+bsd/sys/vm.h
+bsd/sys/vmmeter.h
+bsd/sys/vmparam.h
+bsd/sys/vnode.h
+bsd/sys/vnode_if.h
+bsd/sys/vnode_internal.h
+bsd/sys/vsock.h
+bsd/sys/vsock_domain.h
+bsd/sys/vsock_transport.h
+bsd/sys/wait.h
+bsd/sys/work_interval.h
+bsd/sys/xattr.h
+bsd/uuid/uuid.h
+bsd/vfs/vfs_disk_conditioner.h
+bsd/vfs/vfs_support.h
+bsd/vm/vnode_pager.h
+bsm/audit.h
+bsm/audit_domain.h
+bsm/audit_errno.h
+bsm/audit_fcntl.h
+bsm/audit_internal.h
+bsm/audit_kevents.h
+bsm/audit_record.h
+bsm/audit_socket_type.h
+corecrypto/cc.h
+corecrypto/cc_config.h
+corecrypto/cc_error.h
+corecrypto/cc_fault_canary.h
+corecrypto/cc_macros.h
+corecrypto/cc_priv.h
+corecrypto/cc_runtime_config.h
+corecrypto/ccaes.h
+corecrypto/ccasn1.h
+corecrypto/ccchacha20poly1305.h
+corecrypto/cccmac.h
+corecrypto/ccdes.h
+corecrypto/ccdigest.h
+corecrypto/ccdigest_priv.h
+corecrypto/ccdrbg.h
+corecrypto/ccdrbg_impl.h
+corecrypto/cchmac.h
+corecrypto/cckprng.h
+corecrypto/ccmd4.h
+corecrypto/ccmode.h
+corecrypto/ccmode_impl.h
+corecrypto/ccmode_siv.h
+corecrypto/ccmode_siv_hmac.h
+corecrypto/ccn.h
+corecrypto/ccpad.h
+corecrypto/ccrng.h
+corecrypto/ccrsa.h
+corecrypto/ccsha1.h
+corecrypto/ccsha2.h
+corecrypto/cczp.h
+corecrypto/fipspost_trace.h
+corpses/task_corpse.h
+default_pager/default_pager_types.h
+device/device.defs
+device/device_port.h
+device/device_types.defs
+device/device_types.h
+gethostuuid.h
+gethostuuid_private.h
+iokit/DriverKit/IOBufferMemoryDescriptor.h
+iokit/DriverKit/IODMACommand.h
+iokit/DriverKit/IODataQueueDispatchSource.h
+iokit/DriverKit/IODispatchQueue.h
+iokit/DriverKit/IODispatchSource.h
+iokit/DriverKit/IOInterruptDispatchSource.h
+iokit/DriverKit/IOKitKeys.h
+iokit/DriverKit/IOMemoryDescriptor.h
+iokit/DriverKit/IOMemoryMap.h
+iokit/DriverKit/IORPC.h
+iokit/DriverKit/IOReturn.h
+iokit/DriverKit/IOService.h
+iokit/DriverKit/IOServiceNotificationDispatchSource.h
+iokit/DriverKit/IOTypes.h
+iokit/DriverKit/IOUserClient.h
+iokit/DriverKit/IOUserServer.h
+iokit/DriverKit/OSAction.h
+iokit/DriverKit/OSObject.h
+iokit/IOKit/AppleKeyStoreInterface.h
+iokit/IOKit/IOBSD.h
+iokit/IOKit/IOBufferMemoryDescriptor.h
+iokit/IOKit/IOCPU.h
+iokit/IOKit/IOCatalogue.h
+iokit/IOKit/IOCommand.h
+iokit/IOKit/IOCommandGate.h
+iokit/IOKit/IOCommandPool.h
+iokit/IOKit/IOCommandQueue.h
+iokit/IOKit/IOConditionLock.h
+iokit/IOKit/IODMACommand.h
+iokit/IOKit/IODMAController.h
+iokit/IOKit/IODMAEventSource.h
+iokit/IOKit/IODataQueue.h
+iokit/IOKit/IODataQueueShared.h
+iokit/IOKit/IODeviceMemory.h
+iokit/IOKit/IODeviceTreeSupport.h
+iokit/IOKit/IOEventSource.h
+iokit/IOKit/IOFilterInterruptEventSource.h
+iokit/IOKit/IOHibernatePrivate.h
+iokit/IOKit/IOInterleavedMemoryDescriptor.h
+iokit/IOKit/IOInterruptAccounting.h
+iokit/IOKit/IOInterruptController.h
+iokit/IOKit/IOInterruptEventSource.h
+iokit/IOKit/IOInterrupts.h
+iokit/IOKit/IOKernelReportStructs.h
+iokit/IOKit/IOKernelReporters.h
+iokit/IOKit/IOKitDebug.h
+iokit/IOKit/IOKitDiagnosticsUserClient.h
+iokit/IOKit/IOKitKeys.h
+iokit/IOKit/IOKitKeysPrivate.h
+iokit/IOKit/IOKitServer.h
+iokit/IOKit/IOLib.h
+iokit/IOKit/IOLocks.h
+iokit/IOKit/IOLocksPrivate.h
+iokit/IOKit/IOMapper.h
+iokit/IOKit/IOMemoryCursor.h
+iokit/IOKit/IOMemoryDescriptor.h
+iokit/IOKit/IOMessage.h
+iokit/IOKit/IOMultiMemoryDescriptor.h
+iokit/IOKit/IONVRAM.h
+iokit/IOKit/IONotifier.h
+iokit/IOKit/IOPMGR.h
+iokit/IOKit/IOPlatformActions.h
+iokit/IOKit/IOPlatformExpert.h
+iokit/IOKit/IOPolledInterface.h
+iokit/IOKit/IORPC.h
+iokit/IOKit/IORangeAllocator.h
+iokit/IOKit/IORegistryEntry.h
+iokit/IOKit/IOReportMacros.h
+iokit/IOKit/IOReportTypes.h
+iokit/IOKit/IOReturn.h
+iokit/IOKit/IOService.h
+iokit/IOKit/IOServicePM.h
+iokit/IOKit/IOSharedDataQueue.h
+iokit/IOKit/IOSharedLock.h
+iokit/IOKit/IOStatistics.h
+iokit/IOKit/IOStatisticsPrivate.h
+iokit/IOKit/IOSubMemoryDescriptor.h
+iokit/IOKit/IOSyncer.h
+iokit/IOKit/IOTimeStamp.h
+iokit/IOKit/IOTimerEventSource.h
+iokit/IOKit/IOTypes.h
+iokit/IOKit/IOUserClient.h
+iokit/IOKit/IOUserServer.h
+iokit/IOKit/IOWorkLoop.h
+iokit/IOKit/OSMessageNotification.h
+iokit/IOKit/PassthruInterruptController.h
+iokit/IOKit/assert.h
+iokit/IOKit/nvram/IONVRAMController.h
+iokit/IOKit/platform/AppleMacIO.h
+iokit/IOKit/platform/AppleMacIODevice.h
+iokit/IOKit/platform/AppleNMI.h
+iokit/IOKit/platform/ApplePlatformExpert.h
+iokit/IOKit/platform/IOPlatformIO.h
+iokit/IOKit/power/IOPwrController.h
+iokit/IOKit/pwr_mgt/IOPM.h
+iokit/IOKit/pwr_mgt/IOPMLibDefs.h
+iokit/IOKit/pwr_mgt/IOPMPowerSource.h
+iokit/IOKit/pwr_mgt/IOPMPowerSourceList.h
+iokit/IOKit/pwr_mgt/IOPMpowerState.h
+iokit/IOKit/pwr_mgt/IOPowerConnection.h
+iokit/IOKit/pwr_mgt/RootDomain.h
+iokit/IOKit/rtc/IORTCController.h
+iokit/IOKit/system.h
+iokit/IOKit/system_management/IOWatchDogTimer.h
+kern/exc_guard.h
+kern/exc_resource.h
+kern/kcdata.h
+kern/kern_cdata.h
+libkern/OSByteOrder.h
+libkern/OSDebug.h
+libkern/OSKextLib.h
+libkern/OSReturn.h
+libkern/OSTypes.h
+libkern/_OSByteOrder.h
+libkern/arm/OSByteOrder.h
+libkern/firehose/chunk_private.h
+libkern/firehose/firehose_types_private.h
+libkern/firehose/ioctl_private.h
+libkern/firehose/tracepoint_private.h
+libkern/libkern/Block.h
+libkern/libkern/Block_private.h
+libkern/libkern/OSAtomic.h
+libkern/libkern/OSBase.h
+libkern/libkern/OSByteOrder.h
+libkern/libkern/OSDebug.h
+libkern/libkern/OSKextLib.h
+libkern/libkern/OSKextLibPrivate.h
+libkern/libkern/OSMalloc.h
+libkern/libkern/OSReturn.h
+libkern/libkern/OSSerializeBinary.h
+libkern/libkern/OSTypes.h
+libkern/libkern/_OSByteOrder.h
+libkern/libkern/arm/OSByteOrder.h
+libkern/libkern/c++/OSAllocation.h
+libkern/libkern/c++/OSArray.h
+libkern/libkern/c++/OSBoolean.h
+libkern/libkern/c++/OSBoundedArray.h
+libkern/libkern/c++/OSBoundedArrayRef.h
+libkern/libkern/c++/OSBoundedPtr.h
+libkern/libkern/c++/OSBoundedPtrFwd.h
+libkern/libkern/c++/OSCPPDebug.h
+libkern/libkern/c++/OSCollection.h
+libkern/libkern/c++/OSCollectionIterator.h
+libkern/libkern/c++/OSContainers.h
+libkern/libkern/c++/OSData.h
+libkern/libkern/c++/OSDictionary.h
+libkern/libkern/c++/OSEndianTypes.h
+libkern/libkern/c++/OSIterator.h
+libkern/libkern/c++/OSKext.h
+libkern/libkern/c++/OSLib.h
+libkern/libkern/c++/OSMetaClass.h
+libkern/libkern/c++/OSNumber.h
+libkern/libkern/c++/OSObject.h
+libkern/libkern/c++/OSOrderedSet.h
+libkern/libkern/c++/OSPtr.h
+libkern/libkern/c++/OSSerialize.h
+libkern/libkern/c++/OSSet.h
+libkern/libkern/c++/OSSharedPtr.h
+libkern/libkern/c++/OSString.h
+libkern/libkern/c++/OSSymbol.h
+libkern/libkern/c++/OSUnserialize.h
+libkern/libkern/c++/bounded_array.h
+libkern/libkern/c++/bounded_array_ref.h
+libkern/libkern/c++/bounded_ptr.h
+libkern/libkern/c++/bounded_ptr_fwd.h
+libkern/libkern/c++/intrusive_shared_ptr.h
+libkern/libkern/c++/safe_allocation.h
+libkern/libkern/crc.h
+libkern/libkern/crypto/aes.h
+libkern/libkern/crypto/aesxts.h
+libkern/libkern/crypto/chacha20poly1305.h
+libkern/libkern/crypto/crypto_internal.h
+libkern/libkern/crypto/des.h
+libkern/libkern/crypto/md5.h
+libkern/libkern/crypto/rand.h
+libkern/libkern/crypto/register_crypto.h
+libkern/libkern/crypto/rsa.h
+libkern/libkern/crypto/sha1.h
+libkern/libkern/crypto/sha2.h
+libkern/libkern/img4/interface.h
+libkern/libkern/kernel_mach_header.h
+libkern/libkern/kext_request_keys.h
+libkern/libkern/kxld.h
+libkern/libkern/kxld_types.h
+libkern/libkern/locks.h
+libkern/libkern/machine/OSByteOrder.h
+libkern/libkern/mkext.h
+libkern/libkern/prelink.h
+libkern/libkern/ptrauth_utils.h
+libkern/libkern/section_keywords.h
+libkern/libkern/stack_protector.h
+libkern/libkern/sysctl.h
+libkern/libkern/tree.h
+libkern/libkern/version.h
+libkern/libkern/zconf.h
+libkern/libkern/zlib.h
+libkern/machine/OSByteOrder.h
+libkern/os/atomic.h
+libkern/os/atomic_private.h
+libkern/os/atomic_private_arch.h
+libkern/os/atomic_private_impl.h
+libkern/os/base.h
+libkern/os/base_private.h
+libkern/os/cpp_util.h
+libkern/os/hash.h
+libkern/os/log.h
+libkern/os/log_private.h
+libkern/os/object.h
+libkern/os/overflow.h
+libkern/os/ptrtools.h
+libkern/os/reason_private.h
+libkern/os/refcnt.h
+libkern/os/refcnt_internal.h
+libkern/os/trace.h
+mach/arm/_structs.h
+mach/arm/asm.h
+mach/arm/boolean.h
+mach/arm/exception.h
+mach/arm/kern_return.h
+mach/arm/ndr_def.h
+mach/arm/processor_info.h
+mach/arm/rpc.h
+mach/arm/sdt_isa.h
+mach/arm/syscall_sw.h
+mach/arm/thread_state.h
+mach/arm/thread_status.h
+mach/arm/traps.h
+mach/arm/vm_param.h
+mach/arm/vm_types.h
+mach/arm64/asm.h
+mach/audit_triggers.defs
+mach/audit_triggers_types.h
+mach/boolean.h
+mach/bootstrap.h
+mach/clock.defs
+mach/clock.h
+mach/clock_priv.defs
+mach/clock_priv.h
+mach/clock_reply.defs
+mach/clock_reply.h
+mach/clock_types.defs
+mach/clock_types.h
+mach/dyld_kernel.h
+mach/error.h
+mach/exc.defs
+mach/exc.h
+mach/exception.h
+mach/exception_types.h
+mach/host_info.h
+mach/host_notify.h
+mach/host_notify_reply.defs
+mach/host_priv.defs
+mach/host_priv.h
+mach/host_reboot.h
+mach/host_security.defs
+mach/host_security.h
+mach/host_special_ports.h
+mach/kern_return.h
+mach/kmod.h
+mach/lock_set.defs
+mach/lock_set.h
+mach/mach.h
+mach/mach_error.h
+mach/mach_eventlink.h
+mach/mach_exc.defs
+mach/mach_host.defs
+mach/mach_host.h
+mach/mach_init.h
+mach/mach_interface.h
+mach/mach_param.h
+mach/mach_port.defs
+mach/mach_port.h
+mach/mach_port_internal.h
+mach/mach_right.h
+mach/mach_syscalls.h
+mach/mach_time.h
+mach/mach_traps.h
+mach/mach_types.defs
+mach/mach_types.h
+mach/mach_vm.defs
+mach/mach_vm.h
+mach/mach_vm_internal.h
+mach/mach_voucher.defs
+mach/mach_voucher.h
+mach/mach_voucher_attr_control.defs
+mach/mach_voucher_types.h
+mach/machine.h
+mach/machine/_structs.h
+mach/machine/asm.h
+mach/machine/boolean.h
+mach/machine/exception.h
+mach/machine/kern_return.h
+mach/machine/machine_types.defs
+mach/machine/ndr_def.h
+mach/machine/processor_info.h
+mach/machine/rpc.h
+mach/machine/sdt.h
+mach/machine/sdt_isa.h
+mach/machine/thread_state.h
+mach/machine/thread_status.h
+mach/machine/vm_param.h
+mach/machine/vm_types.h
+mach/memory_entry.defs
+mach/memory_entry.h
+mach/memory_object_types.h
+mach/message.h
+mach/mig.h
+mach/mig_errors.h
+mach/mig_strncpy_zerofill_support.h
+mach/mig_voucher_support.h
+mach/ndr.h
+mach/notify.defs
+mach/notify.h
+mach/policy.h
+mach/port.h
+mach/port_obj.h
+mach/processor.defs
+mach/processor.h
+mach/processor_info.h
+mach/processor_set.defs
+mach/processor_set.h
+mach/rpc.h
+mach/sdt.h
+mach/semaphore.h
+mach/shared_memory_server.h
+mach/shared_region.h
+mach/std_types.defs
+mach/std_types.h
+mach/sync.h
+mach/sync_policy.h
+mach/task.defs
+mach/task.h
+mach/task_access.defs
+mach/task_info.h
+mach/task_inspect.h
+mach/task_policy.h
+mach/task_special_ports.h
+mach/telemetry_notification.defs
+mach/thread_act.defs
+mach/thread_act.h
+mach/thread_act_internal.h
+mach/thread_info.h
+mach/thread_policy.h
+mach/thread_special_ports.h
+mach/thread_state.h
+mach/thread_status.h
+mach/thread_switch.h
+mach/time_value.h
+mach/vm_attributes.h
+mach/vm_behavior.h
+mach/vm_inherit.h
+mach/vm_map.defs
+mach/vm_map.h
+mach/vm_map_internal.h
+mach/vm_page_size.h
+mach/vm_param.h
+mach/vm_prot.h
+mach/vm_purgable.h
+mach/vm_region.h
+mach/vm_statistics.h
+mach/vm_sync.h
+mach/vm_task.h
+mach/vm_types.h
+mach_debug/hash_info.h
+mach_debug/ipc_info.h
+mach_debug/lockgroup_info.h
+mach_debug/mach_debug.h
+mach_debug/mach_debug_types.defs
+mach_debug/mach_debug_types.h
+mach_debug/page_info.h
+mach_debug/vm_info.h
+mach_debug/zone_info.h
+machine/_limits.h
+machine/_mcontext.h
+machine/_param.h
+machine/_types.h
+machine/byte_order.h
+machine/endian.h
+machine/fasttrap_isa.h
+machine/limits.h
+machine/param.h
+machine/profile.h
+machine/signal.h
+machine/types.h
+machine/vmparam.h
+machine_types.modulemap
+miscfs/devfs/devfs.h
+miscfs/specfs/specdev.h
+miscfs/union/union.h
+net/bpf.h
+net/dlil.h
+net/ethernet.h
+net/if.h
+net/if_arp.h
+net/if_dl.h
+net/if_llc.h
+net/if_media.h
+net/if_mib.h
+net/if_types.h
+net/if_utun.h
+net/if_var.h
+net/kext_net.h
+net/ndrv.h
+net/net_kev.h
+net/pfkeyv2.h
+net/route.h
+netinet/bootp.h
+netinet/icmp6.h
+netinet/icmp_var.h
+netinet/if_ether.h
+netinet/igmp.h
+netinet/igmp_var.h
+netinet/in.h
+netinet/in_pcb.h
+netinet/in_systm.h
+netinet/in_var.h
+netinet/ip.h
+netinet/ip6.h
+netinet/ip_icmp.h
+netinet/ip_var.h
+netinet/tcp.h
+netinet/tcp_fsm.h
+netinet/tcp_seq.h
+netinet/tcp_timer.h
+netinet/tcp_var.h
+netinet/tcpip.h
+netinet/udp.h
+netinet/udp_var.h
+netinet6/ah.h
+netinet6/esp.h
+netinet6/in6.h
+netinet6/in6_var.h
+netinet6/ipcomp.h
+netinet6/ipsec.h
+netinet6/nd6.h
+netinet6/raw_ip6.h
+netinet6/scope6_var.h
+netkey/keysock.h
+nfs/krpc.h
+nfs/nfs.h
+nfs/nfs_gss.h
+nfs/nfs_ioctl.h
+nfs/nfs_lock.h
+nfs/nfsdiskless.h
+nfs/nfsm_subs.h
+nfs/nfsmount.h
+nfs/nfsnode.h
+nfs/nfsproto.h
+nfs/nfsrvcache.h
+nfs/rpcv2.h
+nfs/xdr_subs.h
+os/atomic.h
+os/base.h
+os/overflow.h
+os/tsd.h
+osfmk/UserNotification/KUNCUserNotifications.h
+osfmk/UserNotification/UNDReply.defs
+osfmk/UserNotification/UNDRequest.defs
+osfmk/UserNotification/UNDTypes.defs
+osfmk/UserNotification/UNDTypes.h
+osfmk/arm/arch.h
+osfmk/arm/atomic.h
+osfmk/arm/caches_internal.h
+osfmk/arm/cpu_capabilities.h
+osfmk/arm/cpu_number.h
+osfmk/arm/cpu_x86_64_capabilities.h
+osfmk/arm/cpuid.h
+osfmk/arm/cpuid_internal.h
+osfmk/arm/dbgwrap.h
+osfmk/arm/io_map_entries.h
+osfmk/arm/lock.h
+osfmk/arm/locks.h
+osfmk/arm/machine_cpu.h
+osfmk/arm/machine_cpuid.h
+osfmk/arm/machine_kpc.h
+osfmk/arm/machine_routines.h
+osfmk/arm/memory_types.h
+osfmk/arm/monotonic.h
+osfmk/arm/pal_routines.h
+osfmk/arm/pmap_public.h
+osfmk/arm/proc_reg.h
+osfmk/arm/simple_lock.h
+osfmk/arm/smp.h
+osfmk/arm/thread.h
+osfmk/arm/trap.h
+osfmk/arm64/asm.h
+osfmk/arm64/lowglobals.h
+osfmk/arm64/machine_cpuid.h
+osfmk/arm64/machine_kpc.h
+osfmk/arm64/machine_remote_time.h
+osfmk/arm64/monotonic.h
+osfmk/arm64/pal_hibernate.h
+osfmk/arm64/pgtrace.h
+osfmk/arm64/proc_reg.h
+osfmk/arm64/tlb.h
+osfmk/atm/atm_internal.h
+osfmk/atm/atm_notification.defs
+osfmk/atm/atm_types.defs
+osfmk/atm/atm_types.h
+osfmk/bank/bank_types.h
+osfmk/console/serial_protos.h
+osfmk/console/video_console.h
+osfmk/corpses/task_corpse.h
+osfmk/default_pager/default_pager_types.h
+osfmk/device/device.defs
+osfmk/device/device_port.h
+osfmk/device/device_types.defs
+osfmk/device/device_types.h
+osfmk/gssd/gssd_mach.defs
+osfmk/gssd/gssd_mach.h
+osfmk/gssd/gssd_mach_types.h
+osfmk/ipc/ipc_types.h
+osfmk/kdp/kdp_callout.h
+osfmk/kdp/kdp_dyld.h
+osfmk/kdp/kdp_en_debugger.h
+osfmk/kern/affinity.h
+osfmk/kern/arcade.h
+osfmk/kern/arithmetic_128.h
+osfmk/kern/assert.h
+osfmk/kern/audit_sessionport.h
+osfmk/kern/backtrace.h
+osfmk/kern/bits.h
+osfmk/kern/block_hint.h
+osfmk/kern/btlog.h
+osfmk/kern/cambria_layout.h
+osfmk/kern/circle_queue.h
+osfmk/kern/clock.h
+osfmk/kern/coalition.h
+osfmk/kern/cpu_data.h
+osfmk/kern/cpu_number.h
+osfmk/kern/cpu_quiesce.h
+osfmk/kern/cs_blobs.h
+osfmk/kern/debug.h
+osfmk/kern/ecc.h
+osfmk/kern/energy_perf.h
+osfmk/kern/exc_guard.h
+osfmk/kern/exc_resource.h
+osfmk/kern/extmod_statistics.h
+osfmk/kern/host.h
+osfmk/kern/hv_support.h
+osfmk/kern/hv_support_kext.h
+osfmk/kern/ipc_kobject.h
+osfmk/kern/ipc_mig.h
+osfmk/kern/ipc_misc.h
+osfmk/kern/kalloc.h
+osfmk/kern/kcdata.h
+osfmk/kern/kern_cdata.h
+osfmk/kern/kern_types.h
+osfmk/kern/kext_alloc.h
+osfmk/kern/kpc.h
+osfmk/kern/ledger.h
+osfmk/kern/lock.h
+osfmk/kern/lock_group.h
+osfmk/kern/lock_stat.h
+osfmk/kern/locks.h
+osfmk/kern/mach_param.h
+osfmk/kern/macro_help.h
+osfmk/kern/monotonic.h
+osfmk/kern/mpqueue.h
+osfmk/kern/mpsc_queue.h
+osfmk/kern/page_decrypt.h
+osfmk/kern/percpu.h
+osfmk/kern/pms.h
+osfmk/kern/policy_internal.h
+osfmk/kern/priority_queue.h
+osfmk/kern/processor.h
+osfmk/kern/queue.h
+osfmk/kern/remote_time.h
+osfmk/kern/restartable.h
+osfmk/kern/sched_clutch.h
+osfmk/kern/sched_prim.h
+osfmk/kern/sfi.h
+osfmk/kern/simple_lock.h
+osfmk/kern/startup.h
+osfmk/kern/task.h
+osfmk/kern/telemetry.h
+osfmk/kern/thread.h
+osfmk/kern/thread_call.h
+osfmk/kern/thread_group.h
+osfmk/kern/timer_call.h
+osfmk/kern/trustcache.h
+osfmk/kern/turnstile.h
+osfmk/kern/ux_handler.h
+osfmk/kern/waitq.h
+osfmk/kern/work_interval.h
+osfmk/kern/zalloc.h
+osfmk/kextd/kextd_mach.defs
+osfmk/kextd/kextd_mach.h
+osfmk/kperf/action.h
+osfmk/kperf/context.h
+osfmk/kperf/kdebug_trigger.h
+osfmk/kperf/kperf.h
+osfmk/kperf/kperfbsd.h
+osfmk/kperf/kptimer.h
+osfmk/kperf/lazy.h
+osfmk/kperf/pet.h
+osfmk/lockd/lockd_mach.defs
+osfmk/lockd/lockd_mach.h
+osfmk/lockd/lockd_mach_types.h
+osfmk/mach/arcade_upcall_server.h
+osfmk/mach/arm/_structs.h
+osfmk/mach/arm/asm.h
+osfmk/mach/arm/boolean.h
+osfmk/mach/arm/exception.h
+osfmk/mach/arm/kern_return.h
+osfmk/mach/arm/ndr_def.h
+osfmk/mach/arm/processor_info.h
+osfmk/mach/arm/rpc.h
+osfmk/mach/arm/sdt_isa.h
+osfmk/mach/arm/syscall_sw.h
+osfmk/mach/arm/thread_state.h
+osfmk/mach/arm/thread_status.h
+osfmk/mach/arm/traps.h
+osfmk/mach/arm/vm_param.h
+osfmk/mach/arm/vm_types.h
+osfmk/mach/arm64/asm.h
+osfmk/mach/audit_triggers.defs
+osfmk/mach/audit_triggers_server.h
+osfmk/mach/audit_triggers_types.h
+osfmk/mach/boolean.h
+osfmk/mach/clock.defs
+osfmk/mach/clock.h
+osfmk/mach/clock_priv.defs
+osfmk/mach/clock_priv.h
+osfmk/mach/clock_reply.defs
+osfmk/mach/clock_reply_server.h
+osfmk/mach/clock_types.defs
+osfmk/mach/clock_types.h
+osfmk/mach/coalition.h
+osfmk/mach/coalition_notification_server.h
+osfmk/mach/dyld_kernel.h
+osfmk/mach/error.h
+osfmk/mach/exc.defs
+osfmk/mach/exc_server.h
+osfmk/mach/exception.h
+osfmk/mach/exception_types.h
+osfmk/mach/fairplayd_notification_server.h
+osfmk/mach/host_info.h
+osfmk/mach/host_notify.h
+osfmk/mach/host_notify_reply.defs
+osfmk/mach/host_priv.defs
+osfmk/mach/host_priv.h
+osfmk/mach/host_reboot.h
+osfmk/mach/host_security.defs
+osfmk/mach/host_security.h
+osfmk/mach/host_special_ports.h
+osfmk/mach/kern_return.h
+osfmk/mach/kmod.h
+osfmk/mach/ktrace_background.h
+osfmk/mach/lock_set.defs
+osfmk/mach/lock_set.h
+osfmk/mach/mach_eventlink_types.h
+osfmk/mach/mach_exc.defs
+osfmk/mach/mach_exc_server.h
+osfmk/mach/mach_host.defs
+osfmk/mach/mach_host.h
+osfmk/mach/mach_interface.h
+osfmk/mach/mach_param.h
+osfmk/mach/mach_port.defs
+osfmk/mach/mach_port.h
+osfmk/mach/mach_syscalls.h
+osfmk/mach/mach_time.h
+osfmk/mach/mach_traps.h
+osfmk/mach/mach_types.defs
+osfmk/mach/mach_types.h
+osfmk/mach/mach_vm.defs
+osfmk/mach/mach_vm.h
+osfmk/mach/mach_voucher.defs
+osfmk/mach/mach_voucher.h
+osfmk/mach/mach_voucher_attr_control.defs
+osfmk/mach/mach_voucher_attr_control.h
+osfmk/mach/mach_voucher_types.h
+osfmk/mach/machine.h
+osfmk/mach/machine/_structs.h
+osfmk/mach/machine/asm.h
+osfmk/mach/machine/boolean.h
+osfmk/mach/machine/exception.h
+osfmk/mach/machine/kern_return.h
+osfmk/mach/machine/machine_types.defs
+osfmk/mach/machine/ndr_def.h
+osfmk/mach/machine/processor_info.h
+osfmk/mach/machine/rpc.h
+osfmk/mach/machine/sdt.h
+osfmk/mach/machine/sdt_isa.h
+osfmk/mach/machine/syscall_sw.h
+osfmk/mach/machine/thread_state.h
+osfmk/mach/machine/thread_status.h
+osfmk/mach/machine/vm_param.h
+osfmk/mach/machine/vm_types.h
+osfmk/mach/memory_entry.defs
+osfmk/mach/memory_entry.h
+osfmk/mach/memory_object_control.h
+osfmk/mach/memory_object_default_server.h
+osfmk/mach/memory_object_types.h
+osfmk/mach/message.h
+osfmk/mach/mig.h
+osfmk/mach/mig_errors.h
+osfmk/mach/mig_strncpy_zerofill_support.h
+osfmk/mach/mig_voucher_support.h
+osfmk/mach/ndr.h
+osfmk/mach/notify.defs
+osfmk/mach/notify.h
+osfmk/mach/notify_server.h
+osfmk/mach/policy.h
+osfmk/mach/port.h
+osfmk/mach/processor.defs
+osfmk/mach/processor.h
+osfmk/mach/processor_info.h
+osfmk/mach/processor_set.defs
+osfmk/mach/processor_set.h
+osfmk/mach/resource_monitors.h
+osfmk/mach/rpc.h
+osfmk/mach/sdt.h
+osfmk/mach/semaphore.h
+osfmk/mach/sfi_class.h
+osfmk/mach/shared_memory_server.h
+osfmk/mach/shared_region.h
+osfmk/mach/std_types.defs
+osfmk/mach/std_types.h
+osfmk/mach/sync_policy.h
+osfmk/mach/syscall_sw.h
+osfmk/mach/sysdiagnose_notification_server.h
+osfmk/mach/task.defs
+osfmk/mach/task.h
+osfmk/mach/task_access.defs
+osfmk/mach/task_access.h
+osfmk/mach/task_access_server.h
+osfmk/mach/task_info.h
+osfmk/mach/task_inspect.h
+osfmk/mach/task_policy.h
+osfmk/mach/task_special_ports.h
+osfmk/mach/telemetry_notification.defs
+osfmk/mach/telemetry_notification_server.h
+osfmk/mach/thread_act.defs
+osfmk/mach/thread_act.h
+osfmk/mach/thread_info.h
+osfmk/mach/thread_policy.h
+osfmk/mach/thread_special_ports.h
+osfmk/mach/thread_status.h
+osfmk/mach/thread_switch.h
+osfmk/mach/time_value.h
+osfmk/mach/upl.h
+osfmk/mach/vfs_nspace.h
+osfmk/mach/vfs_nspace_server.h
+osfmk/mach/vm_attributes.h
+osfmk/mach/vm_behavior.h
+osfmk/mach/vm_inherit.h
+osfmk/mach/vm_map.defs
+osfmk/mach/vm_map.h
+osfmk/mach/vm_param.h
+osfmk/mach/vm_prot.h
+osfmk/mach/vm_purgable.h
+osfmk/mach/vm_region.h
+osfmk/mach/vm_statistics.h
+osfmk/mach/vm_sync.h
+osfmk/mach/vm_types.h
+osfmk/mach_debug/hash_info.h
+osfmk/mach_debug/ipc_info.h
+osfmk/mach_debug/lockgroup_info.h
+osfmk/mach_debug/mach_debug.h
+osfmk/mach_debug/mach_debug_types.defs
+osfmk/mach_debug/mach_debug_types.h
+osfmk/mach_debug/page_info.h
+osfmk/mach_debug/vm_info.h
+osfmk/mach_debug/zone_info.h
+osfmk/machine/atomic.h
+osfmk/machine/config.h
+osfmk/machine/cpu_capabilities.h
+osfmk/machine/cpu_number.h
+osfmk/machine/io_map_entries.h
+osfmk/machine/lock.h
+osfmk/machine/locks.h
+osfmk/machine/machine_cpuid.h
+osfmk/machine/machine_kpc.h
+osfmk/machine/machine_remote_time.h
+osfmk/machine/machine_routines.h
+osfmk/machine/memory_types.h
+osfmk/machine/monotonic.h
+osfmk/machine/pal_hibernate.h
+osfmk/machine/pal_routines.h
+osfmk/machine/simple_lock.h
+osfmk/machine/smp.h
+osfmk/machine/trap.h
+osfmk/prng/entropy.h
+osfmk/prng/random.h
+osfmk/string.h
+osfmk/tests/ktest.h
+osfmk/tests/xnupost.h
+osfmk/vm/WKdm_new.h
+osfmk/vm/memory_types.h
+osfmk/vm/pmap.h
+osfmk/vm/vm_compressor_algorithms.h
+osfmk/vm/vm_fault.h
+osfmk/vm/vm_kern.h
+osfmk/vm/vm_map.h
+osfmk/vm/vm_options.h
+osfmk/vm/vm_pageout.h
+osfmk/vm/vm_protos.h
+osfmk/vm/vm_shared_region.h
+osfmk/voucher/ipc_pthread_priority_types.h
+pexpert/boot.h
+pexpert/machine/boot.h
+pexpert/machine/protos.h
+pexpert/pexpert.h
+pexpert/pexpert/arm/AIC.h
+pexpert/pexpert/arm/PL192_VIC.h
+pexpert/pexpert/arm/S3cUART.h
+pexpert/pexpert/arm/T8002.h
+pexpert/pexpert/arm/board_config.h
+pexpert/pexpert/arm/boot.h
+pexpert/pexpert/arm/consistent_debug.h
+pexpert/pexpert/arm/dockchannel.h
+pexpert/pexpert/arm/protos.h
+pexpert/pexpert/arm64/AIC.h
+pexpert/pexpert/arm64/BCM2837.h
+pexpert/pexpert/arm64/H7.h
+pexpert/pexpert/arm64/H8.h
+pexpert/pexpert/arm64/H9.h
+pexpert/pexpert/arm64/S3c2410x.h
+pexpert/pexpert/arm64/apple_arm64_common.h
+pexpert/pexpert/arm64/apple_arm64_regs.h
+pexpert/pexpert/arm64/board_config.h
+pexpert/pexpert/arm64/boot.h
+pexpert/pexpert/arm64/spr_locks.h
+pexpert/pexpert/boot.h
+pexpert/pexpert/device_tree.h
+pexpert/pexpert/machine/boot.h
+pexpert/pexpert/machine/protos.h
+pexpert/pexpert/pexpert.h
+pexpert/pexpert/protos.h
+pexpert/protos.h
+san/san/kasan.h
+san/san/ksancov.h
+san/san/memintrinsics.h
+security/audit/audit_ioctl.h
+security/security/_label.h
+security/security/mac.h
+security/security/mac_data.h
+security/security/mac_framework.h
+security/security/mac_internal.h
+security/security/mac_mach_internal.h
+security/security/mac_policy.h
+servers/key_defs.h
+servers/ls_defs.h
+servers/netname.h
+servers/netname_defs.h
+servers/nm_defs.h
+sys/_endian.h
+sys/_posix_availability.h
+sys/_select.h
+sys/_structs.h
+sys/_symbol_aliasing.h
+sys/_types.h
+sys/_types/_blkcnt_t.h
+sys/_types/_blksize_t.h
+sys/_types/_caddr_t.h
+sys/_types/_clock_t.h
+sys/_types/_ct_rune_t.h
+sys/_types/_dev_t.h
+sys/_types/_errno_t.h
+sys/_types/_fd_clr.h
+sys/_types/_fd_copy.h
+sys/_types/_fd_def.h
+sys/_types/_fd_isset.h
+sys/_types/_fd_set.h
+sys/_types/_fd_setsize.h
+sys/_types/_fd_zero.h
+sys/_types/_filesec_t.h
+sys/_types/_fsblkcnt_t.h
+sys/_types/_fsfilcnt_t.h
+sys/_types/_fsid_t.h
+sys/_types/_fsobj_id_t.h
+sys/_types/_gid_t.h
+sys/_types/_guid_t.h
+sys/_types/_id_t.h
+sys/_types/_in_addr_t.h
+sys/_types/_in_port_t.h
+sys/_types/_ino64_t.h
+sys/_types/_ino_t.h
+sys/_types/_int16_t.h
+sys/_types/_int32_t.h
+sys/_types/_int64_t.h
+sys/_types/_int8_t.h
+sys/_types/_intptr_t.h
+sys/_types/_iovec_t.h
+sys/_types/_key_t.h
+sys/_types/_mach_port_t.h
+sys/_types/_mbstate_t.h
+sys/_types/_mode_t.h
+sys/_types/_nlink_t.h
+sys/_types/_null.h
+sys/_types/_o_dsync.h
+sys/_types/_o_sync.h
+sys/_types/_off_t.h
+sys/_types/_offsetof.h
+sys/_types/_os_inline.h
+sys/_types/_pid_t.h
+sys/_types/_posix_vdisable.h
+sys/_types/_ptrdiff_t.h
+sys/_types/_rsize_t.h
+sys/_types/_rune_t.h
+sys/_types/_s_ifmt.h
+sys/_types/_sa_family_t.h
+sys/_types/_seek_set.h
+sys/_types/_sigaltstack.h
+sys/_types/_sigset_t.h
+sys/_types/_size_t.h
+sys/_types/_socklen_t.h
+sys/_types/_ssize_t.h
+sys/_types/_suseconds_t.h
+sys/_types/_time_t.h
+sys/_types/_timespec.h
+sys/_types/_timeval.h
+sys/_types/_timeval32.h
+sys/_types/_timeval64.h
+sys/_types/_u_char.h
+sys/_types/_u_int.h
+sys/_types/_u_int16_t.h
+sys/_types/_u_int32_t.h
+sys/_types/_u_int64_t.h
+sys/_types/_u_int8_t.h
+sys/_types/_u_short.h
+sys/_types/_ucontext.h
+sys/_types/_ucontext64.h
+sys/_types/_uid_t.h
+sys/_types/_uintptr_t.h
+sys/_types/_useconds_t.h
+sys/_types/_uuid_t.h
+sys/_types/_va_list.h
+sys/_types/_wchar_t.h
+sys/_types/_wint_t.h
+sys/acct.h
+sys/aio.h
+sys/appleapiopts.h
+sys/attr.h
+sys/buf.h
+sys/cdefs.h
+sys/clonefile.h
+sys/commpage.h
+sys/conf.h
+sys/dir.h
+sys/dirent.h
+sys/disk.h
+sys/dkstat.h
+sys/domain.h
+sys/dtrace.h
+sys/dtrace_glue.h
+sys/dtrace_impl.h
+sys/errno.h
+sys/ev.h
+sys/event.h
+sys/fasttrap.h
+sys/fasttrap_isa.h
+sys/fcntl.h
+sys/file.h
+sys/filedesc.h
+sys/filio.h
+sys/fsgetpath.h
+sys/gmon.h
+sys/ioccom.h
+sys/ioctl.h
+sys/ioctl_compat.h
+sys/ipc.h
+sys/kauth.h
+sys/kdebug.h
+sys/kdebug_signpost.h
+sys/kern_control.h
+sys/kern_event.h
+sys/kernel.h
+sys/kernel_types.h
+sys/lctx.h
+sys/loadable_fs.h
+sys/lock.h
+sys/lockf.h
+sys/lockstat.h
+sys/log_data.h
+sys/malloc.h
+sys/mbuf.h
+sys/mman.h
+sys/mount.h
+sys/msg.h
+sys/msgbuf.h
+sys/netport.h
+sys/param.h
+sys/paths.h
+sys/pipe.h
+sys/poll.h
+sys/posix_sem.h
+sys/posix_shm.h
+sys/proc.h
+sys/proc_info.h
+sys/protosw.h
+sys/ptrace.h
+sys/queue.h
+sys/quota.h
+sys/random.h
+sys/reboot.h
+sys/resource.h
+sys/resourcevar.h
+sys/sbuf.h
+sys/sdt.h
+sys/select.h
+sys/sem.h
+sys/semaphore.h
+sys/shm.h
+sys/signal.h
+sys/signalvar.h
+sys/snapshot.h
+sys/socket.h
+sys/socketvar.h
+sys/sockio.h
+sys/spawn.h
+sys/stat.h
+sys/stdio.h
+sys/sys_domain.h
+sys/syscall.h
+sys/sysctl.h
+sys/syslimits.h
+sys/syslog.h
+sys/termios.h
+sys/time.h
+sys/timeb.h
+sys/times.h
+sys/timex.h
+sys/tprintf.h
+sys/trace.h
+sys/tty.h
+sys/ttychars.h
+sys/ttycom.h
+sys/ttydefaults.h
+sys/ttydev.h
+sys/types.h
+sys/ubc.h
+sys/ucontext.h
+sys/ucred.h
+sys/uio.h
+sys/un.h
+sys/unistd.h
+sys/unpcb.h
+sys/user.h
+sys/utfconv.h
+sys/utsname.h
+sys/vadvise.h
+sys/vcmd.h
+sys/vm.h
+sys/vmmeter.h
+sys/vmparam.h
+sys/vnioctl.h
+sys/vnode.h
+sys/vnode_if.h
+sys/vsock.h
+sys/vstat.h
+sys/wait.h
+sys/xattr.h
+sys__types.modulemap
+sys_cdefs.modulemap
+sys_types.modulemap
+system-version-compat-support.h
+uuid/uuid.h
+vfs/vfs_support.h
+voucher/ipc_pthread_priority_types.h
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers.txt b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt
similarity index 100%
rename from pkgs/os-specific/darwin/apple-source-releases/xnu/headers.txt
rename to pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index e16c2dffe50aa..5ef0b0b0ea7f4 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -108,10 +108,6 @@ stdenv.mkDerivation rec {
     "-DTCAM_INTERNAL_ARAVIS=OFF"
     "-DTCAM_ARAVIS_USB_VISION=${if withAravis && withAravisUsbVision then "ON" else "OFF"}"
     "-DTCAM_INSTALL_FORCE_PREFIX=ON"
-    # There are gobject introspection commands launched as part of the build. Those have a runtime
-    # dependency on `libtcam` (which itself is built as part of this build). In order to allow
-    # that, we set the dynamic linker's path to point on the build time location of the library.
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
   ];
 
   doCheck = true;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 51eb20ecacdf7..cb323e623beda 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -8,15 +8,17 @@
 , systemdSupport ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , systemd
 , nlsSupport ? true
+, translateManpages ? true
+, po4a
 }:
 
 stdenv.mkDerivation rec {
   pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
-  version = "2.37.4";
+  version = "2.38";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
-    sha256 = "sha256-Y05pFq2RM2bDU2tkaOeER2lUm5mnsr+AMU3nirVlW4M=";
+    hash = "sha256-bREcvk1VszbbLx++/7xluJkIcEwBE2Nx0yqpvsNz62Q=";
   };
 
   patches = [
@@ -51,6 +53,7 @@ stdenv.mkDerivation rec {
     (lib.withFeature systemdSupport "systemd")
     (lib.withFeatureAs systemdSupport
        "systemdsystemunitdir" "${placeholder "bin"}/lib/systemd/system/")
+    (lib.enableFeature translateManpages "poman")
     "SYSCONFSTATICDIR=${placeholder "lib"}/lib"
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
        "scanf_cv_type_modifier=ms"
@@ -62,7 +65,9 @@ stdenv.mkDerivation rec {
     "usrsbin_execdir=${placeholder "bin"}/sbin"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config ]
+    ++ lib.optionals translateManpages [ po4a ];
+
   buildInputs = [ zlib ]
     ++ lib.optionals pamSupport [ pam ]
     ++ lib.optionals capabilitiesSupport [ libcap_ng ]
diff --git a/pkgs/servers/geospatial/mapserver/default.nix b/pkgs/servers/geospatial/mapserver/default.nix
index 9ec9ad01bc873..e643f790bb57c 100644
--- a/pkgs/servers/geospatial/mapserver/default.nix
+++ b/pkgs/servers/geospatial/mapserver/default.nix
@@ -47,6 +47,9 @@ stdenv.mkDerivation rec {
     "-DWITH_CURL=ON"
     "-DWITH_CLIENT_WMS=ON"
     "-DWITH_CLIENT_WFS=ON"
+
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ] ++ lib.optional withPython "-DWITH_PYTHON=ON";
 
   meta = with lib; {
diff --git a/pkgs/servers/sql/mysql/5.7.x.nix b/pkgs/servers/sql/mysql/5.7.x.nix
index 5f876b455e3ff..2b86df4f9d065 100644
--- a/pkgs/servers/sql/mysql/5.7.x.nix
+++ b/pkgs/servers/sql/mysql/5.7.x.nix
@@ -31,7 +31,6 @@ self = stdenv.mkDerivation rec {
   outputs = [ "out" "static" ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # To run libmysql/libmysql_api_test during build.
     "-DWITH_SSL=yes"
     "-DWITH_EMBEDDED_SERVER=yes"
     "-DWITH_UNIT_TESTS=no"
diff --git a/pkgs/servers/sql/mysql/8.0.x.nix b/pkgs/servers/sql/mysql/8.0.x.nix
index f7611d253e5bb..25115eafeb8c8 100644
--- a/pkgs/servers/sql/mysql/8.0.x.nix
+++ b/pkgs/servers/sql/mysql/8.0.x.nix
@@ -34,7 +34,6 @@ self = stdenv.mkDerivation rec {
   outputs = [ "out" "static" ];
 
   cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # To run libmysql/libmysql_api_test during build.
     "-DFORCE_UNSUPPORTED_COMPILER=1" # To configure on Darwin.
     "-DWITH_ROUTER=OFF" # It may be packaged separately.
     "-DWITH_SYSTEM_LIBS=ON"
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index fa07f437d7b84..ef5b58787f33a 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -15,6 +15,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0a2r4sxky3k7b3kdb5pbv709q9b5zi3gxjz336wl66f828vqkbgz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -30,6 +31,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "18hiscgljrz10zjcws25bis32nyrg3hzgmiq6scrh7izqmgz0kab";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -45,6 +47,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0kzbv5wh02798l77y9y8d8sjkmzm9cvsn3rjh8a86v5waj50apsb";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXaw xbitmaps libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -60,6 +63,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "04awfwmy3f9f0bchidc4ssbgrbicn5gzasg3jydpfnp5513d76h8";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXaw libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -75,13 +79,14 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0caafx0yqqnqyvbalxhh3mb0r9v36xmcy5zjhygb2i508dhy35mx";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobe100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontadobe100dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-adobe-100dpi";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -90,14 +95,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0m60f5bd0caambrk8ksknb5dks7wzsg7g7xaf0j21jxmx8rq9h5j";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobe75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontadobe75dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-adobe-75dpi";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -106,14 +112,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "02advcv9lyxpvrjv8bjh1b797lzg6jvhipclz49z8r8y98g4l0n6";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobeutopia100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontadobeutopia100dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-adobe-utopia-100dpi";
     version = "1.0.4";
     builder = ./builder.sh;
@@ -122,14 +129,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "19dd9znam1ah72jmdh7i6ny2ss2r6m21z9v0l43xvikw48zmwvyi";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobeutopia75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontadobeutopia75dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-adobe-utopia-75dpi";
     version = "1.0.4";
     builder = ./builder.sh;
@@ -138,14 +146,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "152wigpph5wvl4k9m3l4mchxxisgsnzlx033mn5iqrpkc6f72cl7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobeutopiatype1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
+  fontadobeutopiatype1 = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, mkfontscale }: stdenv.mkDerivation {
     pname = "font-adobe-utopia-type1";
     version = "1.0.4";
     builder = ./builder.sh;
@@ -154,8 +163,9 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0xw0pdnzj5jljsbbhakc6q9ha2qnca1jr81zk7w70yl9bw83b54p";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -170,13 +180,14 @@ lib.makeScope newScope (self: with self; {
       sha256 = "16ic8wfwwr3jicaml7b5a0sk6plcgc1kg84w02881yhwmqm3nicb";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontarabicmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontarabicmisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-arabic-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -185,14 +196,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1x246dfnxnmflzf0qzy62k8jdpkb6jkgspcjgbk8jcq9lw99npah";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbh100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontbh100dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bh-100dpi";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -201,14 +213,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "10cl4gm38dw68jzln99ijix730y7cbx8np096gmpjjwff1i73h13";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbh75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontbh75dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bh-75dpi";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -217,14 +230,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "073jmhf0sr2j1l8da97pzsqj805f7mf9r2gy92j4diljmi8sm1il";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhlucidatypewriter100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontbhlucidatypewriter100dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bh-lucidatypewriter-100dpi";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -233,14 +247,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1fqzckxdzjv4802iad2fdrkpaxl4w0hhs9lxlkyraq2kq9ik7a32";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhlucidatypewriter75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontbhlucidatypewriter75dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bh-lucidatypewriter-75dpi";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -249,14 +264,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0cfbxdp5m12cm7jsh3my0lym9328cgm7fa9faz2hqj05wbxnmhaa";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhttf = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
+  fontbhttf = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bh-ttf";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -265,14 +281,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0pyjmc0ha288d4i4j0si4dh3ncf3jiwwjljvddrb0k8v4xiyljqv";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhtype1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
+  fontbhtype1 = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bh-type1";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -281,14 +298,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1hb3iav089albp4sdgnlh50k47cdjif9p4axm0kkjvs8jyi5a53n";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstream100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontbitstream100dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bitstream-100dpi";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -297,14 +315,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1kmn9jbck3vghz6rj3bhc3h0w6gh0qiaqm90cjkqsz1x9r2dgq7b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstream75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontbitstream75dpi = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bitstream-75dpi";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -313,14 +332,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "13plbifkvfvdfym6gjbgy9wx2xbdxi9hfrl1k22xayy02135wgxs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstreamtype1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
+  fontbitstreamtype1 = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, mkfontscale }: stdenv.mkDerivation {
     pname = "font-bitstream-type1";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -329,14 +349,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1256z0jhcf5gbh1d03593qdwnag708rxqa032izmfb5dmmlhbsn6";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontcronyxcyrillic = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontcronyxcyrillic = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-cronyx-cyrillic";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -345,14 +366,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0ai1v4n61k8j9x2a1knvfbl2xjxk3xxmqaq3p9vpqrspc69k31kf";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontcursormisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontcursormisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-cursor-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -361,14 +383,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0dd6vfiagjc4zmvlskrbjz85jfqhf060cpys8j0y1qpcbsrkwdhp";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontdaewoomisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontdaewoomisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-daewoo-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -377,14 +400,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1s2bbhizzgbbbn5wqs3vw53n619cclxksljvm759h9p1prqdwrdw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontdecmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontdecmisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-dec-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -393,14 +417,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0yzza0l4zwyy7accr1s8ab7fjqkpwggqydbm2vc19scdby5xz7g1";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontibmtype1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
+  fontibmtype1 = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, mkfontscale }: stdenv.mkDerivation {
     pname = "font-ibm-type1";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -409,14 +434,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1pyjll4adch3z5cg663s6vhi02k8m6488f0mrasg81ssvg9jinzx";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontisasmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontisasmisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-isas-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -425,14 +451,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0rx8q02rkx673a7skkpnvfkg28i8gmqzgf25s9yi0lar915sn92q";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontjismisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontjismisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-jis-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -441,14 +468,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0rdc3xdz12pnv951538q6wilx8mrdndpkphpbblszsv7nc8cw61b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmicromisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontmicromisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-micro-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -457,14 +485,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1dldxlh54zq1yzfnrh83j5vm0k4ijprrs5yl18gm3n9j1z0q2cws";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmisccyrillic = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontmisccyrillic = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-misc-cyrillic";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -473,14 +502,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0q2ybxs8wvylvw95j6x9i800rismsmx4b587alwbfqiw6biy63z4";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmiscethiopic = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
+  fontmiscethiopic = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, mkfontscale }: stdenv.mkDerivation {
     pname = "font-misc-ethiopic";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -489,14 +519,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "19cq7iq0pfad0nc2v28n681fdq3fcw1l1hzaq0wpkgpx7bc1zjsk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmiscmeltho = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
+  fontmiscmeltho = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, mkfontscale }: stdenv.mkDerivation {
     pname = "font-misc-meltho";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -505,14 +536,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "148793fqwzrc3bmh2vlw5fdiwjc2n7vs25cic35gfp452czk489p";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmiscmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontmiscmisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-misc-misc";
     version = "1.1.2";
     builder = ./builder.sh;
@@ -521,14 +553,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "150pq6n8n984fah34n3k133kggn9v0c5k07igv29sxp1wi07krxq";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmuttmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontmuttmisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-mutt-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -537,14 +570,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "13qghgr1zzpv64m0p42195k1kc77pksiv059fdvijz1n6kdplpxx";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontschumachermisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
+  fontschumachermisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-schumacher-misc";
     version = "1.1.2";
     builder = ./builder.sh;
@@ -553,14 +587,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0nkym3n48b4v36y4s927bbkjnsmicajarnf6vlp7wxp0as304i74";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf fontutil mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontscreencyrillic = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontscreencyrillic = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-screen-cyrillic";
     version = "1.0.4";
     builder = ./builder.sh;
@@ -569,14 +604,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0yayf1qlv7irf58nngddz2f1q04qkpr5jwp4aja2j5gyvzl32hl2";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontsonymisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontsonymisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-sony-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -585,14 +621,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1xfgcx4gsgik5mkgkca31fj3w72jw9iw76qyrajrsz1lp8ka6hr0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontsunmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontsunmisc = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-sun-misc";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -601,8 +638,9 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1q6jcqrffg9q5f5raivzwx9ffvf7r11g6g0b125na1bhpz5ly7s8";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -617,6 +655,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0r1s43ypy0a9z6hzdq5y02s2acj965rax4flwdyylvc54ppv86qs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libfontenc freetype xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -632,13 +671,14 @@ lib.makeScope newScope (self: with self; {
       sha256 = "08drjb6cf84pf5ysghjpb4i7xkd2p86k3wl2a0jxs1jif6qbszma";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontwinitzkicyrillic = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
+  fontwinitzkicyrillic = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, bdftopcf, mkfontscale }: stdenv.mkDerivation {
     pname = "font-winitzki-cyrillic";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -647,14 +687,15 @@ lib.makeScope newScope (self: with self; {
       sha256 = "181n1bgq8vxfxqicmy1jpm1hnr6gwn1kdhl6hr4frjigs1ikpldb";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config bdftopcf mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontxfree86type1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
+  fontxfree86type1 = callPackage ({ stdenv, pkg-config, fetchurl, fontutil, mkfontscale }: stdenv.mkDerivation {
     pname = "font-xfree86-type1";
     version = "1.0.4";
     builder = ./builder.sh;
@@ -663,8 +704,9 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0jp3zc0qfdaqfkgzrb44vi9vi0a8ygb35wp082yz7rvvxhmg9sya";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config mkfontscale ];
-    buildInputs = [ ];
+    buildInputs = [ fontutil ];
     configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -679,6 +721,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1r1fpy5ni8chbgx7j5sz0008fpb6vbazpy1nifgdhgijyzqxqxdj";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -694,6 +737,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1ik0mdidmyvy48hn8p2hwvf3535rf3m96hhf0mvcqrbj44x23vp6";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libICE xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -709,6 +753,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0gvpwfk9kvlfn631dgizc45qc2qqjn9pavdp2q7qb3drkvr64fyp";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -724,6 +769,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "00m7l90ws72k1qm101sd2rx92ckd50cszyng5d4dd77jncbf9lmq";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -739,6 +785,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0r8x28n45q89x91mz8mv0zkkcxi8wazkac886fyvflhiv2y8ap2y";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext ];
     meta.platforms = lib.platforms.unix;
@@ -754,6 +801,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "03xxyvpfa3rhqcld4p2chkil482jn9cp80hj17jdybcv2hkkgqf8";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xtrans ];
     meta.platforms = lib.platforms.unix;
@@ -769,6 +817,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0j638yvmyna2k4mz465jywgdybgdchdqppfx6xfazg7l5khxr1kg";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xtrans ];
     meta.platforms = lib.platforms.unix;
@@ -784,6 +833,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1fwwfq9v3sqmpzpscymswxn76xhxnysa24pfim1mcpxhvjcl89id";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libICE libuuid xorgproto xtrans ];
     meta.platforms = lib.platforms.unix;
@@ -799,6 +849,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1p0flwb67xawyv6yhri9w17m1i4lji5qnd0gq8v1vsfb8zw7rw15";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext ];
     meta.platforms = lib.platforms.unix;
@@ -814,6 +865,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0v7aj8q3rlchdyfwdna7n7vgpyzyir391dlv5rwy9fxagbikbyhw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libxcb xtrans ];
     meta.platforms = lib.platforms.unix;
@@ -829,6 +881,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1y4vx1vabg7j9hamp0vrfrax5b0lmgm3h0lbgbb3hnkv3dd0f5zr";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext ];
     meta.platforms = lib.platforms.unix;
@@ -844,6 +897,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0bi5wxj6avim61yidh9fd3j4n8czxias5m8vss9vhxjnk1aksdwg";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext libXt ];
     meta.platforms = lib.platforms.unix;
@@ -859,6 +913,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1v3krc6x0zliaa66qq1bf9j60x5nqfy68v8axaiglxpnvgqcpy6c";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -874,6 +929,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "13kg59r3086383g1dyhnwxanhp2frssh9062mrgn34nzlf7gkbkn";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext xorgproto libXmu libXpm libXt ];
     meta.platforms = lib.platforms.unix;
@@ -889,6 +945,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0i653s8g25cc0mimkwid9366bqkbyhdyjhckx7bw77j20hzrkfid";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext libXmu libXpm xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -904,6 +961,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "13sfcglvz87vl58hd9rszwr73z0z4nwga3c12rfh7f5s2ln8l8dk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXfixes ];
     meta.platforms = lib.platforms.unix;
@@ -919,6 +977,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "10l7c9fm0jmpkm9ab9dz8r6m1pr87vvgqjnbx1psz50h4pwfklrs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXfixes libXrender ];
     meta.platforms = lib.platforms.unix;
@@ -934,6 +993,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0igaw2akjf712y3rv7lx473jigxmcv9rs9y8sbrvbhya8f30cd5p";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXfixes ];
     meta.platforms = lib.platforms.unix;
@@ -949,6 +1009,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0ab53h0rkq721ihk5hi469x500f3pgbkm1wy01yf24x5m923nli0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -964,6 +1025,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0azqxllcsfxc3ilhz6kwc6x7m8wc477p59ir9p0yrsldx766zbar";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -979,6 +1041,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0k2v4i4r24y3kdr5ici1qqhp69djnja919xfqp54c2rylm6s5hd7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 ];
     meta.platforms = lib.platforms.unix;
@@ -994,6 +1057,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0hiji1bvpl78aj3a3141hkk353aich71wv8l5l2z51scfy878zqs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libfontenc xorgproto freetype xtrans zlib ];
     meta.platforms = lib.platforms.unix;
@@ -1009,6 +1073,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0gmm20p3qq23pd2bhc5rsxil60wqvj9xi7l1nh55q8gp3hhnyz5a";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libfontenc xorgproto freetype xtrans zlib ];
     meta.platforms = lib.platforms.unix;
@@ -1024,6 +1089,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1pdbr6gzfvixc791pjf42i9gg8wvfq6cpq6sdca04h4i42mxmpjp";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ fontconfig freetype libX11 xorgproto libXrender ];
     meta.platforms = lib.platforms.unix;
@@ -1039,6 +1105,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "005sicls6faddkcj449858i9xz1nafy70y26frsk7iv1d9283l9f";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext libXfixes ];
     meta.platforms = lib.platforms.unix;
@@ -1054,6 +1121,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "086p0axqj57nvkaqa6r00dnr9kyrn1m8blgf0zjy25zpxkbxn200";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1069,6 +1137,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0cdpqnx6258i4l6qhphvkdiyspysg0i5caqjy820kp63wwjk4d4w";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1084,6 +1153,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0mwc2jwmq03b1m9ihax5c6gw2ln8rc70zz4fsj3kb7440nchqdkz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXau libXext ];
     meta.platforms = lib.platforms.unix;
@@ -1099,6 +1169,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "09dc6nwlb2122h02vl64k9x56mxnyqz2gwpga0abfv4bb1bxmlcw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config gettext ];
     buildInputs = [ libX11 libXext xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1114,6 +1185,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "12kvvar3ihf6sw49h6ywfdiwmb8i1gh8wasg1zhzp6hs2hay06n1";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 ];
     meta.platforms = lib.platforms.unix;
@@ -1129,6 +1201,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "08z0mqywrm7ij8bxlfrx0d2wy6kladdmkva1nw5k6qix82z0xsla";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext libXrender ];
     meta.platforms = lib.platforms.unix;
@@ -1144,6 +1217,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0j89cnb06g8x79wmmnwzykgkkfdhin9j7hjpvsxwlr3fz1wmjvf0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 ];
     meta.platforms = lib.platforms.unix;
@@ -1159,6 +1233,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "049b7dk6hx47161hg47ryjrm6pwsp27r5pby05b0wqb1pcggprmn";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext ];
     meta.platforms = lib.platforms.unix;
@@ -1174,6 +1249,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0q1x7842r8rcn2m0q4q9f69h4qa097fyizs8brzx5ns62s7w1737";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libICE xorgproto libSM libX11 ];
     meta.platforms = lib.platforms.unix;
@@ -1189,6 +1265,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "012jpyj7xfm653a9jcfqbzxyywdmwb2b5wr1dwylx14f3f54jma6";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext libXi ];
     meta.platforms = lib.platforms.unix;
@@ -1204,6 +1281,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "125hn06bd3d8y97hm2pbf5j55gg4r2hpd3ifad651i4sr7m16v6j";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext ];
     meta.platforms = lib.platforms.unix;
@@ -1219,6 +1297,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1kbdjsvkm5l7axv7g477qj18sab2wnqhliy6197syzizgfbsfgbb";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext libXv ];
     meta.platforms = lib.platforms.unix;
@@ -1234,6 +1313,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "00vjvcdlc1sga251jkxn6gkxmx9h5n290ffxxpa40qbca1gvr61b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1249,6 +1329,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "107k593sx27vjz3v7gbb223add9i7w0bjc90gbb3jqpin3i07758";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1264,6 +1345,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0mydhlyn72i7brjwypsqrpkls3nm6vxw0li8b2nw0caz7kwjgvmg";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1279,6 +1361,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0hvjfhrcym770cr0zpqajdy3cda30aiwbjzv16iafkqkbl090gr5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext ];
     meta.platforms = lib.platforms.unix;
@@ -1294,6 +1377,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0y90170dp8wsidr1dzza0grxr1lfh30ji3b5vkjz4j6x1n0wxz1c";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto zlib ];
     meta.platforms = lib.platforms.unix;
@@ -1309,6 +1393,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "12glp4w1kgvmqn89lk19cgr6jccd3awxra4dxisp7pagi06rsk11";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ zlib ];
     meta.platforms = lib.platforms.unix;
@@ -1324,6 +1409,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0cz7s9w8lqgzinicd4g36rjg08zhsbyngh0w68c3np8nlc8mkl74";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -1339,6 +1425,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0d2chjgyn5lr9sfhacfvqgnj9l9faz11vn322a06jd6lk3dxcpm5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config python3 ];
     buildInputs = [ libxslt libpthreadstubs libXau xcbproto libXdmcp ];
     meta.platforms = lib.platforms.unix;
@@ -1354,6 +1441,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0acc7vrj5kfb19zvyl7f29rnsvx383dvwc19k70r8prm1lccxsr7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config meson ninja ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -1369,6 +1457,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1irq9crvscd3yb8sr802dhvvfr35jdy1n2yz094xplmd42mbv3bm";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 ];
     meta.platforms = lib.platforms.unix;
@@ -1384,6 +1473,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1ir0j92mnd1nk37mrv9bz5swnccqldicgszvfsh62jd14q6k115q";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1399,6 +1489,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "041bxkvv6f92sm3hhm977c4gdqdv5r1jyxjqcqfi8vkrg3s2j4ka";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libXaw libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1414,6 +1505,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0pdngiy8zdhsiqx2am75yfcl36l7kd7d7nl0rss8shcdvsqgmx29";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1429,6 +1521,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "081rrajj5hpgx3pvm43grqzscnq5kl320q0wq6zzhf6wrijhz41b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -1444,6 +1537,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "072h9nzh8s5vqfz35dli4fba36fnr219asjrb7p89n8ph0paan6m";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1459,6 +1553,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1ixsnsm2mn0zy9ksdid0lj6irnhvasfik9mz8bbrs5sajzmra16a";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libfontenc freetype xorgproto zlib ];
     meta.platforms = lib.platforms.unix;
@@ -1474,6 +1569,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1zmfzfmdp42nvapf0qz1bc3i3waq5sjrpkgfw64qs4nmq30wy86c";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libxkbfile libX11 libXext libXmu libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1489,6 +1585,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0crczl25zynkrslmm8sjaxszhrh4i33m7h5fg4wfdb3k8aarxjyz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1504,6 +1601,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1xdrxs65v7d0rw1yaz0vsz55w4hxym99216p085ya9978j379wlg";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libxkbfile ];
     meta.platforms = lib.platforms.unix;
@@ -1519,6 +1617,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0rkjyzmsdqmlrkx8gy2j4q6iksk58hcc92xzdprkf8kml9ar3wbc";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libICE libSM libXmu libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1534,6 +1633,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "088v8p0yfn4r3azabp6662hqikfs2gjb9xmjjd45gnngwwp19b2b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1549,6 +1649,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1ms5cj1w3g26zg6bxdv1j9hl0pxr4300qnv003cz1q3cl7ffljb4";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libICE libSM libX11 libXext libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1564,6 +1665,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0w8ryfqylprz37zj9grl4jzdsqq67ibfwq5raj7vm1i7kmp2x08g";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -1579,6 +1681,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1mz319kfmvcrdpi22dmdr91mif1j0j3ck1f8mmnz5g1r9kl1in2y";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libXaw libXmu libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1594,6 +1697,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0d3wh6z6znwhfdiv0zaggfj0xgish98xa10yy76b9517zj7hnzhw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext libXft libXmu xorgproto libXrender ];
     meta.platforms = lib.platforms.unix;
@@ -1609,6 +1713,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "032klzzw8r09z36x1272ssd79bcisz8j5p8gbdy111fiknvx27bd";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXau libXext libXmu xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1624,6 +1729,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1plssg0s3pbslg6rfzxp9sx8ryvn8l32zyvc8zp9zsbsfwjg69rs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libxcb xcbutil ];
     meta.platforms = lib.platforms.unix;
@@ -1639,6 +1745,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1vh73sc13s7w5r6gnc6irca56s7998bja7wgdivkfn8jccawgw5r";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -1654,6 +1761,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1sxmlcb0sb3h4z05kl5l0kxnhrc0h8c74p9m3zdc7bv58jaldmym";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXaw xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1669,6 +1777,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1hzwazgyywd9mz4mjj1yv8ski27qqx7ypmyr27m39hrajyddsjph";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config python3 ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -1684,6 +1793,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1sahmrgbpyki4bb72hxym0zvxwnycmswsxiisgqlln9vrdlr9r26";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config m4 ];
     buildInputs = [ gperf libxcb xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1699,6 +1809,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0krr4rcw6r42cncinzvzzdqnmxk3nrgpnadyg2h8k9x10q3hm885";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config m4 ];
     buildInputs = [ gperf libxcb xcbutilimage xcbutilrenderutil xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1714,6 +1825,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "158rm913dg3hxrrhyvvxr8bcm0pjy5jws70dhy2s12w1krv829k8";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config m4 ];
     buildInputs = [ gperf libxcb xcbproto xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1729,6 +1841,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1z1gxacg7q4cw6jrd26gvi5y04npsyavblcdad1xccc8swvnmf9d";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config m4 ];
     buildInputs = [ gperf libxcb xcbutil xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1744,6 +1857,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1nbd45pzc1wm6v5drr5338j4nicbgxa5hcakvsvm5pnyy47lky0f";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config m4 ];
     buildInputs = [ gperf libxcb xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1759,6 +1873,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0nza1csdvvxbmk8vgv8vpmq7q8h05xrw3cfx9lwxd1hjzd47xsf6";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config m4 ];
     buildInputs = [ gperf libxcb xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1774,6 +1889,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0gra7hfyxajic4mjd63cpqvd20si53j1q3rbdlkqkahfciwq3gr8";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config m4 ];
     buildInputs = [ gperf libxcb xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -1789,6 +1905,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1fr3q4rszgx7x2zxy2ip592a3fgx20hfwac49p2l5b7jqsr1ying";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXaw libXft libxkbfile libXmu xorgproto libXrender libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1804,6 +1921,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1ik7gzlp2igz183x70883000ygp99r20x3aah6xhaslbpdhm6n75";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 ];
     meta.platforms = lib.platforms.unix;
@@ -1819,6 +1937,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0hvjkanrdlvk3ln5a1jx3c9ggziism2jr1na7jl3zyk0y3sdm28b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libXcomposite libXdamage libXext libXfixes libXrender ];
     meta.platforms = lib.platforms.unix;
@@ -1834,6 +1953,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1q2ib1626i5da0nda09sp3vzppjrcn82fff83cw7hwr0vy14h56i";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXaw libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1849,6 +1969,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0ggbv084cavp52hjgcz3vdj0g018axs0m23c03lpc5sgn92gidim";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libpng libX11 libXcursor ];
     meta.platforms = lib.platforms.unix;
@@ -1864,6 +1985,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "16a96li0s0ggg60v7f6ywxmsrmxdfizcw55ccv7sp4qjfisca7pf";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libXcursor ];
     meta.platforms = lib.platforms.unix;
@@ -1879,6 +2001,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1x17hdymf6rd8jmh4n1sd4g5a8ayr5w94nwjw84qs2fs5pvq7lhd";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXau libXaw libXdmcp libXext libXft libXinerama libXmu libXpm xorgproto libXrender libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1894,6 +2017,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0ldgrj4w2fa8jng4b3f3biaj0wyn8zvya88pnk70d7k12pcqw8rh";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libdmx libX11 libxcb libXcomposite libXext libXi libXinerama xorgproto libXrender libXtst libXxf86dga libXxf86misc libXxf86vm ];
     meta.platforms = lib.platforms.unix;
@@ -1909,6 +2033,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0lcx8h3zd11m4w8wf7dyp89826d437iz78cyrix436bqx31x5k6r";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libGL xorgproto libX11 ];
     meta.platforms = lib.platforms.unix;
@@ -1924,6 +2049,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1ql592pdhddhkipkrsxn929y9l2nn02a5fh2z3dx47kmzs5y006p";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto libXrandr ];
     meta.platforms = lib.platforms.unix;
@@ -1939,6 +2065,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1nxn443pfhddmwl59wplpjkslhlyfk307qx18nrimvvb2hipx8gq";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libxcb libXext libXi libXmu xorgproto libXrender libXt ];
     meta.platforms = lib.platforms.unix;
@@ -1954,6 +2081,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1h1y0fwnawlp4yc5llr1l7hwfcxxpln2fxhy6arcf6w6h4z0f9l7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libevdev udev mtdev xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -1969,6 +2097,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1awfq496d082brgjbr60lhm6jvr9537rflwxqdfqwfzjy3n6jxly";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -1984,6 +2113,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "12032yg412kyvnmc5fha1in7mpi651d8sa1bk4138s2j2zr01jgp";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -1999,6 +2129,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1xk9b05csndcgcj8kbb6fkwa3c7njzzxc6qvz9bvy77y2k2s63gq";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libinput xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2014,6 +2145,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1iawr1wyl2qch1mqszcs0s84i92mh4xxprflnycbw1adc18b7v4k";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2029,6 +2161,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0xhm03qywwfgkpfl904d08lx00y28m1b6lqmks5nxizixwk3by3s";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libevdev libX11 libXi xorgserver libXtst ];
     meta.platforms = lib.platforms.unix;
@@ -2044,6 +2177,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "06ckn4hlkpig5vnivl0zj8a7ykcgvrsj8b3iccl1pgn1gaamix8a";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto udev xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2059,6 +2193,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "171k8b8s42s3w73l7ln9jqwk88w4l7r1km2blx1vy898c854yvpr";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgserver xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2074,6 +2209,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "125dq85n46yqmnmr2hknxwcqicwlvz2b2phf0m963fpg9l1j6y30";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto mesa libGL libdrm udev xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2089,6 +2225,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0znwqfc8abkiha98an8hxsngnz96z6cd976bc4bsvz1km6wqk0c0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2104,6 +2241,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "07p5vdsj2ckxb6wh02s61akcv4qfg6s1d5ld3jn3lfaayd3f1466";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2119,6 +2257,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1pm2cy81ma7ldsw0yfk28b33h9z2hcj5rccrxhfxfgvxsiavrnqy";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2134,6 +2273,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0gmymk8207fd9rjliq05l2gvx220h432rj3h75hv2ylr3k9vmp2b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto mesa libGL libdrm udev libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2149,6 +2289,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1gqzy7q9v824m7hqkbbmncxg082zm0d4mafgc97c4skyiwgf9wq7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2164,6 +2305,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1asifc6ld2g9kap15vfhvsvyl69lj7pw3d9ra9mi4najllh7pj7d";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2179,6 +2321,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1fcm9vwgv8wnffbvkzddk4yxrh3kc0np6w65wj8k88q7jf3bn4ip";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2194,6 +2337,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "16a66zr0l1lmssa07i3rzy07djxnb45c17ks8c71h8l06xgxihyw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2209,6 +2353,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0zn9gb49grds5mcs1dlrx241k2w1sgqmx4i5x7v6159xxqhlqsf6";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2224,6 +2369,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1vaav6kx4n00q4fawgqnjmbdkppl0dir2dkrj4ad372mxrvl9c4y";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2239,6 +2385,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1lkpspvrvrp9s539bhfdjfh4andaqyk63l6zjn8m3km95smk6a45";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libpciaccess xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2254,6 +2401,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1snhpv1igrhifcls3r498kjd14ml6x2xvih7zk9xlsd1ymmhlb4g";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2269,6 +2417,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0l3s1m95bdsg4gki943qipq8agswbb84dzcflpxa3vlckwhh3r26";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2284,6 +2433,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1jb7jspmzidfixbc0gghyjmnmpqv85i7pi13l4h2hn2ml3p83dq0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ cairo xorgproto libdrm libpng udev libpciaccess libX11 xcbutil libxcb libXcursor libXdamage libXext libXfixes xorgserver libXrandr libXrender libxshmfence libXtst libXvMC ];
     meta.platforms = lib.platforms.unix;
@@ -2299,6 +2449,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0yaxpgyyj9398nzzr5vnsfxcis76z46p9814yzj8179yl7hld296";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2314,6 +2465,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0r4h673kw8fl7afc30anwbjlbhp82mg15fvaxf470xg7z983k0wk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2329,6 +2481,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1yafmp23jrfdmc094i6a4dsizapsc9v0pl65cpc8w1kvn7343k4i";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2344,6 +2497,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0rhs3z274jdzd82pcsl25xn8hmw6i4cxs2kwfnphpfhxbbkiq7wl";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm udev libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2359,6 +2513,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0bdk3pc5y0n7p53q4gc2ff7bw16hy5hwdjjxkm5j3s7hdyg6960z";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2374,6 +2529,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0nmbrx6913dc724y8wj2p6vqfbj5zdjfmsl037v627jj0whx9rwk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2389,6 +2545,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0x9gq3hw6k661k82ikd1y2kkk4dmgv310xr5q59dwn4k6z37aafs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm udev libpciaccess libX11 libXext xorgserver libXvMC ];
     meta.platforms = lib.platforms.unix;
@@ -2404,6 +2561,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "14jc24znnahhmz4kqalafmllsg8awlz0y6gpgdpk5ih38ph851mi";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm udev libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2419,6 +2577,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0snvwmrh8dqyyaq7ggicym6yrsg4brygkx9156r0m095m7fp3rav";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2434,6 +2593,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0yzqcdfrnnyaaaa76d4hpwycpq4x2j8qvg9m4q19lj4xbicwc4cm";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2449,6 +2609,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "06d1v5s7xf00y18x12cz11sk00rgn0yq95w66kmgzy465pzxvj84";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2464,6 +2625,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "11pcrsdpdrwk0mrgv83s5nsx8a9i4lhmivnal3fjbrvi3zdw94rc";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2479,6 +2641,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1g2r6gxqrmjdff95d42msxdw6vmkg2zn5sqv0rxd420iwy8wdwyh";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2494,6 +2657,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0srvrhydjnynfb7b1s145rgmsk4f71iz0ag4icpmb05944d90xr1";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2509,6 +2673,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "090lfs3hjz3cjd016v5dybmcsigj6ffvjdhdsqv13k90p4b08h7l";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2524,6 +2689,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "04fgwgk02m4nimlv67rrg1wnyahgymrn6rb2cjj1l8bmzkii4glr";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2539,6 +2705,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "07z3ngifwg2d4jgq8pms47n5lr2yn0ai72g86xxjnb3k20n5ym7s";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2554,6 +2721,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1gacm0s6rii4x5sx9py5bhvs50jd4vs3nnbwjdjymyf31kpdirl3";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2569,6 +2737,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0qc5wzwf1n65si9rc37bh224pzahh7gp67vfimbxs0b9yvhq0i9g";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2584,6 +2753,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0cb161lvdgi6qnf1sfz722qn38q7kgakcvj7b45ba3i0020828r0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2599,6 +2769,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0gxcar434kx813fxdpb93126lhmkl3ikabaljhcj5qn3fkcijlcy";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2614,6 +2785,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "084x4p4avy72mgm2vnnvkicw3419i6pp3wxik8zqh7gmq4xv5z75";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2629,6 +2801,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "195z1js3i51qgxvhfw4bxb4dw3jcrrx2ynpm2y3475dypjzs7dkz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2644,6 +2817,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0nf6ai74c60xk96kgr8q9mx6lrxm5id3765ws4d801irqzrj85hz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2659,6 +2833,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0v06qhm059klq40m2yx4wypzb7h53aaassbjfmm6clcyclj1k5s7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm udev libpciaccess libX11 libXext xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2674,6 +2849,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1s6p7yxmi12q4y05va53rljwyzd6ry492r1pgi7wwq6cznivhgly";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2689,6 +2865,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0hr8397wpd0by1hc47fqqrnaw3qdqd8aqgwgzv38w5k3l3jy6p4p";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgserver xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2704,6 +2881,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "10xd2vah0pnpw5spn40n4p95mpmgvdkly4i1cz51imnlfsw7g8si";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libdrm libpciaccess xorgserver ];
     meta.platforms = lib.platforms.unix;
@@ -2719,6 +2897,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0n6r1v8sm0z0ycqch035xpm46nv5v4mav3kxh36883l3ln5r6bqr";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config gettext ];
     buildInputs = [ libxkbfile fontconfig libXaw libXft libXmu xorgproto libXrender libXt ];
     meta.platforms = lib.platforms.unix;
@@ -2734,6 +2913,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0700lf6hx7dg88wq1yll7zjvf9gbwh06xff20yffkxb289y0pai5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXaw libXmu libXt ];
     meta.platforms = lib.platforms.unix;
@@ -2749,6 +2929,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0q4q4rbzx159sfn2n52y039fki6nc6a39qdfxa78yjc3aw8i48nv";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libXfont2 xorgproto xtrans ];
     meta.platforms = lib.platforms.unix;
@@ -2764,6 +2945,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1mmir5i7gm71xc0ba8vnizi4744vsd31hknhi4cmgvg6kadqngla";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libFS xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2779,6 +2961,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1lr2nb1fhg5fk2fchqxdxyl739602ggwhmgl2wiv5c8qbidw7w8f";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto libXxf86vm ];
     meta.platforms = lib.platforms.unix;
@@ -2794,6 +2977,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0pigvjd3i9fchmj1inqy151aafz3dr0vq1h2zizdb2imvadqv0hl";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libXaw libXt ];
     meta.platforms = lib.platforms.unix;
@@ -2809,6 +2993,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "15n3mnd4i5kh4z32qv11580qjgvnng0wry2y753ljrqkkrbkrp52";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXau libXmu xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2824,6 +3009,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1fdbakx59vyh474skjydj1bbglpby3y03nl7mxn0z9v8gdhqz6yy";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2839,6 +3025,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1vb6xdd1xmk5f7pwc5zcbxfray5sf1vbnscqwf2yl8lv7gfq38im";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXext libXi libXinerama libXrandr ];
     meta.platforms = lib.platforms.unix;
@@ -2854,6 +3041,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0pmhshqinwqh5rip670l3szjpywky67hv232ql6gvdj489n0hlb8";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libxkbfile xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2869,6 +3057,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0sprjx8i86ljk0l7ldzbz2xlk8916z5zh78cafjv8k1a63js4c14";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libxkbfile ];
     meta.platforms = lib.platforms.unix;
@@ -2884,6 +3073,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "04iyv5z8aqhabv7wcpvbvq0ji0jrz1666vw6gvxkvl7szswalgqb";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libxkbfile xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2899,6 +3089,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0c412isxl65wplhl7nsk12vxlri29lk48g3p52hbrs3m0awqm8fj";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto libX11 libXaw libXt ];
     meta.platforms = lib.platforms.unix;
@@ -2914,6 +3105,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1g6kn7l0mixw50kgn7d97gwv1990c5rczr2x776q3xywss8dfzv5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config python3 ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2929,6 +3121,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0szzd9nzn0ybkhnfyizb876irwnjsnb78rcaxx6prb71jmmbpw65";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXmu xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -2944,6 +3137,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "01sr6yd6yhyyfgn88l867w6h9dn5ikcynaz5rwji6xqxhw1lhkpk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config gettext ];
     buildInputs = [ libX11 libXaw libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
@@ -2959,6 +3153,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "10m3a046jvaw5ywx4y65kl84lsxqan70gww1g1r7cf96ijaqz1jp";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libxcb ];
     meta.platforms = lib.platforms.unix;
@@ -2974,6 +3169,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1h8931sn34mcip6vpi4v7hdmr1r58gkbw4s2p97w98kykks2lgvp";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libxcb ];
     meta.platforms = lib.platforms.unix;
@@ -2989,6 +3185,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0s6kxgv78chkwsqmhw929f4pf91gq63f4yvixxnan1h00cx0pf49";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3004,6 +3201,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0qg12ifbbk9n8fh4jmyb625cknn8ssj86chd6zwdiqjin8ivr8l7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXaw libXmu libXt ];
     meta.platforms = lib.platforms.unix;
@@ -3019,6 +3217,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0a90kfm0qz8cn2pbpqfyqrc5s9bfvvy14nj848ynvw56wy0zng9p";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libXaw libXt ];
     meta.platforms = lib.platforms.unix;
@@ -3034,6 +3233,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0z28331i2pm16x671fa9qwsfqdmr6a43bzwmp0dm17a3sx0hjgs7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3049,6 +3249,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "06r514p30v87vx00ddlck9mwazaqk9bx08ip866p1mw2a46iwjk4";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libXaw libXt ];
     meta.platforms = lib.platforms.unix;
@@ -3064,6 +3265,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0233jyjxjkhlar03vp8l5sm3iq6354izm3crk41h5291pgap39vl";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -3079,6 +3281,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0jrc4jmb4raqawx0j9jmhgasr0k6sxv0bm2hrxjh9hb26iy6gf14";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -3094,6 +3297,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "05d0kib351qmnlfimaznaw0220fr0ym7fx2gn9h2jqxxilxncbxa";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config python3 ];
     buildInputs = [ libXt ];
     meta.platforms = lib.platforms.unix;
@@ -3109,6 +3313,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0sx18vsxr0dg9z7b9ph1gz6q4pmxc1n6b4sbb7i47578kc5vgiaw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ xorgproto openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ];
     meta.platforms = lib.platforms.unix;
@@ -3124,6 +3329,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0k5pffyi5bx8dmfn033cyhgd3gf6viqj3x769fqixifwhbgy2777";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -3139,6 +3345,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "07qy9lwjvxighcmg6qvjkgagad3wwvidrfx0jz85lgynz3qy0dmr";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXmu xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3154,6 +3361,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "18ckr8g1z50zkc01hprkpm1npwbq32yqib4b3l98c95z2q1yv4lv";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3169,6 +3377,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0ql75s1n3dm2m3g1ilb9l6hqh15r0v709bgghpwazy3jknpnvivv";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto libXrandr libXrender ];
     meta.platforms = lib.platforms.unix;
@@ -3184,6 +3393,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1d78prd8sfszq2rwwlb32ksph4fymf988lp75aj8iysg44f06pag";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXmu xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3199,6 +3409,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0lv3rlshh7s0z3aqx5ahnnf8cl082m934bk7gv881mz8nydznz98";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3214,6 +3425,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0my987wjvra7l92ry6q44ky383yg3phzxhdbn3lqhapm1ll9bzg4";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXext libXmu xorgproto libXxf86misc ];
     meta.platforms = lib.platforms.unix;
@@ -3229,6 +3441,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0z21mqvmdl6rl63q77479wgkfygnll57liza1i3va7sr4fx45i0h";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xbitmaps libXcursor libXmu xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3244,6 +3457,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "09a4ss1fnrh1sgm21r4n5pivawf34paci3rn6mscyljf7a4vcd4r";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libICE libSM libX11 libXaw libXt ];
     meta.platforms = lib.platforms.unix;
@@ -3259,6 +3473,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "12vgzsxv4rw25frkgjyli6w6hy10lgpvsx9wzw2v5l5a3qzqp286";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXmu xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3274,6 +3489,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0wyp0yc6gi72hwc3kjmvm3vkj9p6s407cb6dxx37jh9wb68l8z1p";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ ];
     meta.platforms = lib.platforms.unix;
@@ -3289,6 +3505,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0sqm4j1zflk1s94iq4waa70hna1xcys88v9a70w0vdw66czhvj2j";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libXt libXTrap ];
     meta.platforms = lib.platforms.unix;
@@ -3304,6 +3521,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0gz7fvxavqlrqynpfbrm2nc9yx8h0ksnbnv34fj7n1q6cq6j4lq3";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto libXv ];
     meta.platforms = lib.platforms.unix;
@@ -3319,6 +3537,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "06q36fh55r62ms0igfxsanrn6gv8lh794q1bw9xzw51p2qs2papv";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libxkbfile libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3334,6 +3553,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "00avrpw4h5mr1klp41lv2j4dmq465v6l5kb5bhm4k5ml8sm9i543";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 libxcb xorgproto ];
     meta.platforms = lib.platforms.unix;
@@ -3349,6 +3569,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1a8hdgy40smvblnh3s9f0vkqckl68nmivx7d48zk34m8z18p16cr";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libX11 xorgproto ];
     meta.platforms = lib.platforms.unix;
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 69ff9a70155a4..d236eb3cbc414 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -190,6 +190,7 @@
     }
 
     if ($isFont) {
+        push @requires, "fontutil";
         push @{$extraAttrs{$pkg}}, "configureFlags = [ \"--with-fontrootdir=\$(out)/lib/X11/fonts\" ];";
     }
 
@@ -293,10 +294,22 @@
     my $nativeBuildInputsStr = join "", map { $_ . " " } @nativeBuildInputs;
     my $buildInputsStr = join "", map { $_ . " " } @buildInputs;
 
+    sub uniq {
+        my %seen;
+        my @res = ();
+        foreach my $s (@_) {
+            if (!defined $seen{$s}) {
+                $seen{$s} = 1;
+                push @res, $s;
+            }
+        }
+        return @res;
+    }
+
     my @arguments = @buildInputs;
     push @arguments, @nativeBuildInputs;
     unshift @arguments, "stdenv", "pkg-config", "fetchurl";
-    my $argumentsStr = join ", ", @arguments;
+    my $argumentsStr = join ", ", uniq @arguments;
 
     my $extraAttrsStr = "";
     if (defined $extraAttrs{$pkg}) {
@@ -314,6 +327,7 @@
       sha256 = "$pkgHashes{$pkg}";
     };
     hardeningDisable = [ "bindnow" "relro" ];
+    strictDeps = true;
     nativeBuildInputs = [ pkg-config $nativeBuildInputsStr];
     buildInputs = [ $buildInputsStr];$extraAttrsStr
     meta.platforms = lib.platforms.unix;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 2cfd410a33894..e8c6caa721ba5 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -42,7 +42,7 @@ self: super:
   });
 
   encodings = super.encodings.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [ self.mkfontscale ];
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [ self.mkfontscale ];
   });
 
   editres = super.editres.overrideAttrs (attrs: {
@@ -437,9 +437,6 @@ self: super:
 
   xf86inputvoid = brokenOnDarwin super.xf86inputvoid; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86inputvoid.x86_64-darwin
   xf86videodummy = brokenOnDarwin super.xf86videodummy; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videodummy.x86_64-darwin
-  xf86videosuncg6 = brokenOnDarwin super.xf86videosuncg6; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videosuncg6.x86_64-darwin
-  xf86videosunffb = brokenOnDarwin super.xf86videosunffb; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videosunffb.x86_64-darwin
-  xf86videosunleo = brokenOnDarwin super.xf86videosunleo; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videosunleo.x86_64-darwin
 
   # Obsolete drivers that don't compile anymore.
   xf86videoark     = super.xf86videoark.overrideAttrs     (attrs: { meta = attrs.meta // { broken = true; }; });
@@ -463,8 +460,8 @@ self: super:
   });
 
   xf86videoati = super.xf86videoati.overrideAttrs (attrs: {
-    NIX_CFLAGS_COMPILE = "-I${self.xorgserver.dev or self.xorgserver}/include/xorg";
-    nativeBuildInputs = with self; attrs.nativeBuildInputs ++ [ autoreconfHook utilmacros ];
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ];
+    buildInputs =  attrs.buildInputs ++ [ self.utilmacros ];
     patches = [
       (fetchpatch {
         url = "https://gitlab.freedesktop.org/xorg/driver/xf86-video-ati/-/commit/e0511968d04b42abf11bc0ffb387f143582bc144.patch";
@@ -474,7 +471,117 @@ self: super:
   });
 
   xf86videonouveau = super.xf86videonouveau.overrideAttrs (attrs: {
-    nativeBuildInputs = with self; attrs.nativeBuildInputs ++ [ autoreconfHook utilmacros ];
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ];
+    buildInputs =  attrs.buildInputs ++ [ self.utilmacros ];
+  });
+
+  xf86videoglint = super.xf86videoglint.overrideAttrs (attrs: {
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ];
+    buildInputs =  attrs.buildInputs ++ [ self.utilmacros ];
+    # https://gitlab.freedesktop.org/xorg/driver/xf86-video-glint/-/issues/1
+    meta = attrs.meta // { broken = true; };
+  });
+
+  xf86videosuncg6 = super.xf86videosuncg6.overrideAttrs (attrs: {
+    meta = attrs.meta // { broken = isDarwin; }; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videosuncg6.x86_64-darwin
+    # https://gitlab.freedesktop.org/xorg/driver/xf86-video-suncg6/-/commit/14392504de04841fa2cbb5cdf8d9c9c7c4eb2ed8
+    postPatch = ''
+      patch -p1 <<EOF
+      diff --git a/src/cg6.h b/src/cg6.h
+      index 9f176e69dc1f6fc5e35ca20c30a4d3b4faf52623..d6bc19e8767c6aee9e7174a43cf1d71a9f35af32 100644
+      --- a/src/cg6.h
+      +++ b/src/cg6.h
+      @@ -26,7 +26,7 @@
+
+       #include "xf86.h"
+       #include "xf86_OSproc.h"
+      -#include "xf86RamDac.h"
+      +#include "xf86Cursor.h"
+       #include <X11/Xmd.h>
+       #include "gcstruct.h"
+       #include "cg6_regs.h"
+       EOF
+    '';
+  });
+
+  xf86videosunffb = super.xf86videosunffb.overrideAttrs (attrs: {
+    meta = attrs.meta // { broken = isDarwin; }; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videosunffb.x86_64-darwin
+    # https://gitlab.freedesktop.org/xorg/driver/xf86-video-sunffb/-/commit/656dd83b489e7bdc72d6c1990025d20dea26dc22
+    postPatch = ''
+      patch -p1 <<EOF
+      diff --git a/src/ffb.h b/src/ffb.h
+      index 67a2d87afa607b6bea07e53f4be738c1ebb757ab..d87024033fb48a83c50c588866c90cd6eac0975c 100644
+      --- a/src/ffb.h
+      +++ b/src/ffb.h
+      @@ -30,7 +30,7 @@
+
+       #include "xf86.h"
+       #include "xf86_OSproc.h"
+      -#include "xf86RamDac.h"
+      +#include "xf86Cursor.h"
+       #ifdef HAVE_XAA_H
+       #include "xaa.h"
+       #endif
+       EOF
+    '';
+  });
+
+  xf86videosunleo = super.xf86videosunleo.overrideAttrs (attrs: {
+    meta = attrs.meta // { broken = isDarwin; }; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videosunleo.x86_64-darwin
+    # https://gitlab.freedesktop.org/xorg/driver/xf86-video-sunleo/-/commit/f58ba53e6b6fe1b6e21d6aa3901a11e6130b95b0
+    postPatch = ''
+      patch -p1 <<EOF
+      diff --git a/src/leo.h b/src/leo.h
+      index a5bf41d34955d81b7ea14d4da6bc7f65191a3f98..c45c59b71be679333216d289d689a3c06c8dcbf7 100644
+      --- a/src/leo.h
+      +++ b/src/leo.h
+      @@ -26,7 +26,7 @@
+
+       #include "xf86.h"
+       #include "xf86_OSproc.h"
+      -#include "xf86RamDac.h"
+      +#include "xf86Cursor.h"
+       #include <X11/Xmd.h>
+       #include "gcstruct.h"
+       #include "leo_regs.h"
+       EOF
+    '';
+  });
+
+  xf86videotrident = super.xf86videotrident.overrideAttrs (attrs: {
+    # https://gitlab.freedesktop.org/xorg/driver/xf86-video-trident/-/commit/07a5c4732f1c28ffcb873ee04500e3cb813c50b4
+    postPatch = ''
+      patch -p1 <<EOF
+      diff --git a/src/trident.h b/src/trident.h
+      index 5cadf52d3be13f03e94a8f443f1c8a04358296e8..c82de4c7debf3ee42e3b7965b738a6bd6ae9147d 100644
+      --- a/src/trident.h
+      +++ b/src/trident.h
+      @@ -38,7 +38,6 @@
+       #include "xaa.h"
+       #endif
+       #include "xf86fbman.h"
+      -#include "xf86RamDac.h"
+       #include "compiler.h"
+       #include "vgaHW.h"
+       #include "xf86i2c.h"
+      @@ -103,7 +102,6 @@ typedef struct {
+           int			useEXA;
+           int			Chipset;
+           int			DACtype;
+      -    int			RamDac;
+           int                 ChipRev;
+           int			HwBpp;
+           int			BppShift;
+      @@ -169,7 +167,6 @@ typedef struct {
+           CARD32		BltScanDirection;
+           CARD32		DrawFlag;
+           CARD16		LinePattern;
+      -    RamDacRecPtr	RamDacRec;
+           int			CursorOffset;
+           xf86CursorInfoPtr	CursorInfoRec;
+           xf86Int10InfoPtr	Int10;
+       EOF
+    '';
   });
 
   xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
@@ -698,6 +805,23 @@ self: super:
             url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/454b3a826edb5fc6d0fea3a9cfd1a5e8fc568747.diff";
             sha256 = "1l9qg905jvlw3r0kx4xfw5m12pbs0782v2g3267d1m6q4m6fj1zy";
           })
+        ]
+        # TODO: remove with xorgserver >= 21.1.4; https://lists.x.org/archives/xorg/2022-July/061035.html
+        ++ [
+          (fetchpatch {
+            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/f1070c01d616c5f21f939d5ebc533738779451ac.diff";
+            sha256 = "5hcreV3ND8Lklvo7QMpB0VWQ2tifIamRlCr6J82qXt8=";
+          })
+          (fetchpatch {
+            name = "CVE-2022-2319.diff";
+            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/6907b6ea2b4ce949cb07271f5b678d5966d9df42.diff";
+            sha256 = "gWXCalWj2SF4U7wSFGIgK396B0Fs3EtA/EL+34m3FWY=";
+          })
+          (fetchpatch {
+            name = "CVE-2022-2320.diff";
+            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/dd8caf39e9e15d8f302e54045dd08d8ebf1025dc.diff";
+            sha256 = "rBiiXQRreMvexW9vOKblcfCYzul+9La01EAhir4FND8=";
+          })
         ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
         propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
@@ -821,7 +945,8 @@ self: super:
   });
 
   xcursorthemes = super.xcursorthemes.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [ self.xcursorgen self.xorgproto ];
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [ self.xcursorgen ];
+    buildInputs = attrs.buildInputs ++ [ self.xorgproto ];
     configureFlags = [ "--with-cursordir=$(out)/share/icons" ];
   });
 
@@ -867,8 +992,8 @@ self: super:
       rev = "31486f40f8e8f8923ca0799aea84b58799754564";
       sha256 = "sha256-nqT9VZDb2kAC72ot9UCdwEkM1uuP9NriJePulzrdZlM=";
     };
-    buildInputs = attrs.buildInputs ++ [ self.libXScrnSaver self.libXfixes self.libXv self.pixman ];
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [autoreconfHook self.utilmacros];
+    buildInputs = attrs.buildInputs ++ [ self.libXScrnSaver self.libXfixes self.libXv self.pixman self.utilmacros ];
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [autoreconfHook ];
     configureFlags = [ "--with-default-dri=3" "--enable-tools" ];
 
     meta = attrs.meta // {
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index bde8735642d8c..871aed59e35e5 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -330,6 +330,74 @@ else let
         ++ optional (elem "host"   configurePlatforms) "--host=${stdenv.hostPlatform.config}"
         ++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
 
+      cmakeFlags =
+        let
+          explicitFlags =
+            if lib.isString cmakeFlags then lib.warn
+                "String 'cmakeFlags' is deprecated and will be removed in release 23.05. Please use a list of strings. Derivation name: ${derivationArg.name}, file: ${pos.file or "unknown file"}"
+                [cmakeFlags]
+            else if cmakeFlags == null then
+              lib.warn
+                "Null 'cmakeFlags' is deprecated and will be removed in release 23.05. Please use a empty list instead '[]'. Derivation name: ${derivationArg.name}, file: ${pos.file or "unknown file"}"
+                []
+            else
+              cmakeFlags;
+
+          crossFlags = [
+            "-DCMAKE_SYSTEM_NAME=${lib.findFirst lib.isString "Generic" (lib.optional (!stdenv.hostPlatform.isRedox) stdenv.hostPlatform.uname.system)}"
+          ] ++ lib.optionals (stdenv.hostPlatform.uname.processor != null) [
+            "-DCMAKE_SYSTEM_PROCESSOR=${stdenv.hostPlatform.uname.processor}"
+          ] ++ lib.optionals (stdenv.hostPlatform.uname.release != null) [
+            "-DCMAKE_SYSTEM_VERSION=${stdenv.hostPlatform.uname.release}"
+          ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+            "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+          ] ++ lib.optionals (stdenv.buildPlatform.uname.system != null) [
+            "-DCMAKE_HOST_SYSTEM_NAME=${stdenv.buildPlatform.uname.system}"
+          ] ++ lib.optionals (stdenv.buildPlatform.uname.processor != null) [
+            "-DCMAKE_HOST_SYSTEM_PROCESSOR=${stdenv.buildPlatform.uname.processor}"
+          ] ++ lib.optionals (stdenv.buildPlatform.uname.release != null) [
+            "-DCMAKE_HOST_SYSTEM_VERSION=${stdenv.buildPlatform.uname.release}"
+          ];
+        in
+          explicitFlags ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) crossFlags;
+
+      mesonFlags =
+        let
+          explicitFlags =
+            if lib.isString mesonFlags then lib.warn
+                "String 'mesonFlags' is deprecated and will be removed in release 23.05. Please use a list of strings. Derivation name: ${derivationArg.name}, file: ${pos.file or "unknown file"}"
+                [mesonFlags]
+            else if mesonFlags == null then
+              lib.warn
+                "Null 'mesonFlags' is deprecated and will be removed in release 23.05. Please use a empty list instead '[]'. Derivation name: ${derivationArg.name}, file: ${pos.file or "unknown file"}"
+                []
+            else
+              mesonFlags;
+
+          # See https://mesonbuild.com/Reference-tables.html#cpu-families
+          cpuFamily = platform: with platform;
+            /**/ if isAarch32 then "arm"
+            else if isAarch64 then "aarch64"
+            else if isx86_32  then "x86"
+            else if isx86_64  then "x86_64"
+            else platform.parsed.cpu.family + builtins.toString platform.parsed.cpu.bits;
+
+          crossFile = builtins.toFile "cross-file.conf" ''
+            [properties]
+            needs_exe_wrapper = true
+
+            [host_machine]
+            system = '${stdenv.targetPlatform.parsed.kernel.name}'
+            cpu_family = '${cpuFamily stdenv.targetPlatform}'
+            cpu = '${stdenv.targetPlatform.parsed.cpu.name}'
+            endian = ${if stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
+
+            [binaries]
+            llvm-config = 'llvm-config-native'
+          '';
+          crossFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
+        in crossFlags ++ explicitFlags;
+
       inherit patches;
 
       inherit doCheck doInstallCheck;
@@ -341,42 +409,6 @@ else let
       # most people won't care about these anyways
       outputHashAlgo = attrs.outputHashAlgo or "sha256";
       outputHashMode = attrs.outputHashMode or "recursive";
-    } // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
-      cmakeFlags =
-        (/**/ if lib.isString cmakeFlags then [cmakeFlags]
-         else if cmakeFlags == null      then []
-         else                                     cmakeFlags)
-      ++ [ "-DCMAKE_SYSTEM_NAME=${lib.findFirst lib.isString "Generic" (
-           lib.optional (!stdenv.hostPlatform.isRedox) stdenv.hostPlatform.uname.system)}"]
-      ++ lib.optional (stdenv.hostPlatform.uname.processor != null) "-DCMAKE_SYSTEM_PROCESSOR=${stdenv.hostPlatform.uname.processor}"
-      ++ lib.optional (stdenv.hostPlatform.uname.release != null) "-DCMAKE_SYSTEM_VERSION=${stdenv.hostPlatform.uname.release}"
-      ++ lib.optional (stdenv.hostPlatform.isDarwin) "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
-      ++ lib.optional (stdenv.buildPlatform.uname.system != null) "-DCMAKE_HOST_SYSTEM_NAME=${stdenv.buildPlatform.uname.system}"
-      ++ lib.optional (stdenv.buildPlatform.uname.processor != null) "-DCMAKE_HOST_SYSTEM_PROCESSOR=${stdenv.buildPlatform.uname.processor}"
-      ++ lib.optional (stdenv.buildPlatform.uname.release != null) "-DCMAKE_HOST_SYSTEM_VERSION=${stdenv.buildPlatform.uname.release}";
-
-      mesonFlags = if mesonFlags == null then null else let
-        # See https://mesonbuild.com/Reference-tables.html#cpu-families
-        cpuFamily = platform: with platform;
-          /**/ if isAarch32 then "arm"
-          else if isAarch64 then "aarch64"
-          else if isx86_32  then "x86"
-          else if isx86_64  then "x86_64"
-          else platform.parsed.cpu.family + builtins.toString platform.parsed.cpu.bits;
-        crossFile = builtins.toFile "cross-file.conf" ''
-          [properties]
-          needs_exe_wrapper = true
-
-          [host_machine]
-          system = '${stdenv.targetPlatform.parsed.kernel.name}'
-          cpu_family = '${cpuFamily stdenv.targetPlatform}'
-          cpu = '${stdenv.targetPlatform.parsed.cpu.name}'
-          endian = ${if stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
-
-          [binaries]
-          llvm-config = 'llvm-config-native'
-        '';
-      in [ "--cross-file=${crossFile}" ] ++ mesonFlags;
     } // lib.optionalAttrs (enableParallelBuilding) {
       enableParallelChecking = attrs.enableParallelChecking or true;
     } // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != [] || stdenv.hostPlatform.isMusl) {
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 3670f8d8c2bc8..723ebf24fe52c 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -356,9 +356,6 @@ in
       #   stage5.gcc -> stage4.coreutils -> stage3.glibc -> bootstrap
       gmp = lib.makeOverridable (super.gmp.override { stdenv = self.stdenv; }).overrideAttrs (a: { pname = "${a.pname}-stage4"; });
 
-      # coreutils gets rebuilt both here and also in the final stage; we rename this one to avoid confusion
-      coreutils = super.coreutils.overrideAttrs (a: { pname = "${a.pname}-stage4"; });
-
       gcc = lib.makeOverridable (import ../../build-support/cc-wrapper) {
         nativeTools = false;
         nativeLibc = false;
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index 2f2581f04a592..f84f55583f5dc 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -60,7 +60,10 @@ stdenv.mkDerivation rec {
     "generic"
     "D_USE_BZ2=-DUSE_BZIP2"
     "L_BZ2=-lbz2"
-  ];
+  ]
+  # `lchmod` is not available on Linux, so we remove it to fix "not supported" errors (when the zip file contains symlinks).
+  # Alpine (musl) and Debian (glibc) also add this flag.
+  ++ lib.optionals stdenv.isLinux [ "LOCAL_UNZIP=-DNO_LCHMOD" ];
 
   preConfigure = ''
     sed -i -e 's@CF="-O3 -Wall -I. -DASM_CRC $(LOC)"@CF="-O3 -Wall -I. -DASM_CRC -DLARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 $(LOC)"@' unix/Makefile
diff --git a/pkgs/tools/backup/percona-xtrabackup/generic.nix b/pkgs/tools/backup/percona-xtrabackup/generic.nix
index 85e9ac6f364ba..4caafcae679be 100644
--- a/pkgs/tools/backup/percona-xtrabackup/generic.nix
+++ b/pkgs/tools/backup/percona-xtrabackup/generic.nix
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
     "-DWITH_ZLIB=system"
     "-DWITH_VALGRIND=ON"
     "-DWITH_MAN_PAGES=OFF"
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # To run libmysql/libmysql_api_test during build.
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index db02bedf7f940..73e9dd1f01fa1 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -184,8 +184,6 @@ in rec {
       substituteInPlace src/common/module.c --replace "/sbin/modprobe" "modprobe"
       substituteInPlace src/common/module.c --replace "/bin/grep" "grep"
 
-      # for pybind/rgw to find internal dep
-      export LD_LIBRARY_PATH="$PWD/build/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
       # install target needs to be in PYTHONPATH for "*.pth support" check to succeed
       # set PYTHONPATH, so the build system doesn't silently skip installing ceph-volume and others
       export PYTHONPATH=${ceph-python-env}/${sitePackages}:$lib/${sitePackages}:$out/${sitePackages}
diff --git a/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix b/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
index 8d8ae6e71e424..d8cb710b29367 100644
--- a/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
+++ b/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
@@ -30,6 +30,11 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/waifu2x-converter-cpp --prefix LD_LIBRARY_PATH : "${ocl-icd}/lib"
   '';
 
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
   meta = {
     description = "Improved fork of Waifu2X C++ using OpenCL and OpenCV";
     homepage = "https://github.com/DeadSix27/waifu2x-converter-cpp";
diff --git a/pkgs/tools/misc/colord/default.nix b/pkgs/tools/misc/colord/default.nix
index f3d7503b9c9d7..77d06a6848ac3 100644
--- a/pkgs/tools/misc/colord/default.nix
+++ b/pkgs/tools/misc/colord/default.nix
@@ -18,7 +18,7 @@
 , ninja
 , vala
 , libgudev
-, wrapGAppsHook
+, wrapGAppsNoGuiHook
 , shared-mime-info
 , sane-backends
 , docbook_xsl
@@ -26,6 +26,7 @@
 , docbook_xml_dtd_412
 , gtk-doc
 , libxslt
+, enableDaemon ? !stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isStatic
 }:
 
 stdenv.mkDerivation rec {
@@ -56,6 +57,7 @@ stdenv.mkDerivation rec {
     "-Dlibcolordcompat=true"
     "-Dsane=true"
     "-Dvapi=true"
+    "-Ddaemon=${lib.boolToString enableDaemon}"
     "-Ddaemon_user=colord"
   ];
 
@@ -72,7 +74,7 @@ stdenv.mkDerivation rec {
     pkg-config
     shared-mime-info
     vala
-    wrapGAppsHook
+    wrapGAppsNoGuiHook
   ];
 
   buildInputs = [
@@ -83,10 +85,11 @@ stdenv.mkDerivation rec {
     gusb
     lcms2
     libgudev
-    polkit
     sane-backends
     sqlite
     systemd
+  ] ++ lib.optionals enableDaemon [
+    polkit
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 5b8c1c38c5058..90fd78ed04c1c 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -123,7 +123,12 @@ stdenv.mkDerivation rec {
       # TODO(19b98110126fde7cbb1127af7e3fe1568eacad3d): Needed for fstatfs() I
       # don't know why it is not properly detected cross building with glibc.
       "fu_cv_sys_stat_statfs2_bsize=yes"
-    ];
+    ]
+    # /proc/uptime is available on Linux and produces accurate results even if
+    # the boot time is set to the epoch because the system has no RTC. We
+    # explicitly enable it for cases where it can't be detected automatically,
+    # such as when cross-compiling.
+    ++ optional stdenv.hostPlatform.isLinux "gl_cv_have_proc_uptime=yes";
 
   # The tests are known broken on Cygwin
   # (http://article.gmane.org/gmane.comp.gnu.core-utils.bugs/19025),
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
index 606f06d3405c3..051e98862bd2a 100644
--- a/pkgs/tools/misc/hdf4/default.nix
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -88,12 +88,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  preCheck = ''
-    export LD_LIBRARY_PATH=$(pwd)/bin
-  '' + lib.optionalString (stdenv.isDarwin) ''
-    export DYLD_LIBRARY_PATH=$(pwd)/bin
-  '';
-
   excludedTests = lib.optionals stdenv.isDarwin [
     "MFHDF_TEST-hdftest"
     "MFHDF_TEST-hdftest-shared"
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index d342822590262..76efc76678116 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -25,7 +25,7 @@ assert !cppSupport || !mpiSupport;
 let inherit (lib) optional optionals; in
 
 stdenv.mkDerivation rec {
-  version = "1.12.1";
+  version = "1.12.2";
   pname = "hdf5"
     + lib.optionalString cppSupport "-cpp"
     + lib.optionalString fortranSupport "-fortran"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-${lib.versions.majorMinor version}/hdf5-${version}/src/hdf5-${version}.tar.bz2";
-    sha256 = "sha256-qvn1MrPtqD09Otyfi0Cpt2MVIhj6RTScO8d1Asofjxw=";
+    sha256 = "sha256-Goi742ITos6gyDlyAaRZZD5xVcnckeBiZ1s/sH7jiv4=";
   };
 
   passthru = {
@@ -74,8 +74,6 @@ stdenv.mkDerivation rec {
     ++ optionals threadsafe [ "--enable-threadsafe" "--disable-hl" ];
 
   patches = [
-    ./bin-mv.patch
-
     # Avoid non-determinism in autoconf build system:
     # - build time
     # - build user
diff --git a/pkgs/tools/networking/curl/7.83.1-quiche-support-ca-fallback.patch b/pkgs/tools/networking/curl/7.83.1-quiche-support-ca-fallback.patch
deleted file mode 100644
index c68f9f1d84dff..0000000000000
--- a/pkgs/tools/networking/curl/7.83.1-quiche-support-ca-fallback.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-diff --git a/lib/vquic/quiche.c b/lib/vquic/quiche.c
-index bfdc966a85ea..e4bea4d677be 100644
---- a/lib/vquic/quiche.c
-+++ b/lib/vquic/quiche.c
-@@ -201,23 +201,31 @@ static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data)
- 
-   {
-     struct connectdata *conn = data->conn;
--    const char * const ssl_cafile = conn->ssl_config.CAfile;
--    const char * const ssl_capath = conn->ssl_config.CApath;
--
-     if(conn->ssl_config.verifypeer) {
--      SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
--      /* tell OpenSSL where to find CA certificates that are used to verify
--         the server's certificate. */
--      if(!SSL_CTX_load_verify_locations(ssl_ctx, ssl_cafile, ssl_capath)) {
--        /* Fail if we insist on successfully verifying the server. */
--        failf(data, "error setting certificate verify locations:"
--              "  CAfile: %s CApath: %s",
--              ssl_cafile ? ssl_cafile : "none",
--              ssl_capath ? ssl_capath : "none");
--        return NULL;
-+      const char * const ssl_cafile = conn->ssl_config.CAfile;
-+      const char * const ssl_capath = conn->ssl_config.CApath;
-+      if(ssl_cafile || ssl_capath) {
-+        SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
-+        /* tell OpenSSL where to find CA certificates that are used to verify
-+           the server's certificate. */
-+        if(!SSL_CTX_load_verify_locations(ssl_ctx, ssl_cafile, ssl_capath)) {
-+          /* Fail if we insist on successfully verifying the server. */
-+          failf(data, "error setting certificate verify locations:"
-+                "  CAfile: %s CApath: %s",
-+                ssl_cafile ? ssl_cafile : "none",
-+                ssl_capath ? ssl_capath : "none");
-+          return NULL;
-+        }
-+        infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
-+        infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
-       }
--      infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
--      infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
-+#ifdef CURL_CA_FALLBACK
-+      else {
-+        /* verifying the peer without any CA certificates won't work so
-+           use openssl's built-in default as fallback */
-+        SSL_CTX_set_default_verify_paths(ssl_ctx);
-+      }
-+#endif
-     }
-   }
-   return ssl_ctx;
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index cc7fd0c3a8507..44f0918bd209c 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -33,6 +33,8 @@
 , ocamlPackages
 , phpExtensions
 , python3
+, tests
+, fetchpatch
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -44,23 +46,20 @@ assert !(gnutlsSupport && opensslSupport);
 assert !(gnutlsSupport && wolfsslSupport);
 assert !(opensslSupport && wolfsslSupport);
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "7.83.1";
+  version = "7.84.0";
 
   src = fetchurl {
     urls = [
-      "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
-      "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
+      "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.bz2"
+      "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.bz2"
     ];
-    sha256 = "sha256-9Tmjb7RKgmDsXZd+Tg290u7intkPztqpvDyfeKETv/A=";
+    sha256 = "sha256-cC+ybnMZCjvXcHGqFG9Qe5gXzE384hjSq4fwDNO8BZ0=";
   };
 
   patches = [
     ./7.79.1-darwin-no-systemconfiguration.patch
-    # quiche: support ca-fallback
-    # https://github.com/curl/curl/commit/fdb5e21b4dd171a96cf7c002ee77bb08f8e58021
-    ./7.83.1-quiche-support-ca-fallback.patch
   ] ++ lib.optional patchNetrcRegression ./netrc-regression.patch;
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -135,7 +134,10 @@ stdenv.mkDerivation rec {
   CXX = "${stdenv.cc.targetPrefix}c++";
   CXXCPP = "${stdenv.cc.targetPrefix}c++ -E";
 
-  doCheck = true;
+  # takes 14 minutes on a 24 core and because many other packages depend on curl
+  # they cannot be run concurrently and are a bottleneck
+  # tests are available in passthru.tests.withCheck
+  doCheck = false;
   preCheck = ''
     patchShebangs tests/
   '' + lib.optionalString stdenv.isDarwin ''
@@ -160,16 +162,23 @@ stdenv.mkDerivation rec {
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4.4.0
   '';
 
-  passthru = {
+  passthru = let
+    useThisCurl = attr: attr.override { curl = finalAttrs.finalPackage; };
+  in {
     inherit opensslSupport openssl;
     tests = {
-      inherit curlpp coeurl;
-      haskell-curl = haskellPackages.curl;
-      ocaml-curly = ocamlPackages.curly;
-      php-curl = phpExtensions.curl;
-      pycurl = python3.pkgs.pycurl;
+      withCheck = finalAttrs.finalPackage.overrideAttrs (_: { doCheck = true; });
+      fetchpatch = tests.fetchpatch.simple.override { fetchpatch = fetchpatch.override { fetchurl = useThisCurl fetchurl; }; };
+      curlpp = useThisCurl curlpp;
+      coeurl = useThisCurl coeurl;
+      haskell-curl = useThisCurl haskellPackages.curl;
+      ocaml-curly = useThisCurl ocamlPackages.curly;
+      pycurl = useThisCurl python3.pkgs.pycurl;
+      php-curl = useThisCurl phpExtensions.curl;
+      # error: attribute 'override' missing
       # Additional checking with support http3 protocol.
-      inherit (nixosTests) nginx-http3;
+      # nginx-http3 = useThisCurl nixosTests.nginx-http3;
+      nginx-http3 = nixosTests.nginx-http3;
     };
   };
 
@@ -182,4 +191,4 @@ stdenv.mkDerivation rec {
     # Fails to link against static brotli or gss
     broken = stdenv.hostPlatform.isStatic && (brotliSupport || gssSupport);
   };
-}
+})
diff --git a/pkgs/tools/networking/shadowsocks-libev/default.nix b/pkgs/tools/networking/shadowsocks-libev/default.nix
index 0584184a675ed..3ad9161c716b5 100644
--- a/pkgs/tools/networking/shadowsocks-libev/default.nix
+++ b/pkgs/tools/networking/shadowsocks-libev/default.nix
@@ -20,7 +20,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake asciidoc xmlto docbook_xml_dtd_45
                         docbook_xsl libxslt ];
 
-  cmakeFlags = [ "-DWITH_STATIC=OFF"  "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON" ];
+  cmakeFlags = [ "-DWITH_STATIC=OFF"  "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
 
   postInstall = ''
     cp lib/* $out/lib
diff --git a/pkgs/tools/security/yubihsm-shell/default.nix b/pkgs/tools/security/yubihsm-shell/default.nix
index 06a1452400de5..2533e0c787092 100644
--- a/pkgs/tools/security/yubihsm-shell/default.nix
+++ b/pkgs/tools/security/yubihsm-shell/default.nix
@@ -38,11 +38,6 @@ stdenv.mkDerivation rec {
     openssl
   ];
 
-  cmakeFlags = [
-    # help2man fails without this
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
-  ];
-
   postPatch = ''
     # Can't find libyubihsm at runtime because of dlopen() in C code
     substituteInPlace lib/yubihsm.c \
diff --git a/pkgs/tools/text/opencc/default.nix b/pkgs/tools/text/opencc/default.nix
index fbff68abb692c..193c541cfab02 100644
--- a/pkgs/tools/text/opencc/default.nix
+++ b/pkgs/tools/text/opencc/default.nix
@@ -13,13 +13,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake python3 ];
 
-  # let intermediate tools find intermediate library
-  preBuild = lib.optionalString stdenv.isLinux ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/src
-  '' + lib.optionalString stdenv.isDarwin ''
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$(pwd)/src
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/BYVoid/OpenCC";
     license = licenses.asl20;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7babea48246b6..803ceb226595e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9707,6 +9707,8 @@ with pkgs;
 
   pngquant = callPackage ../tools/graphics/pngquant { };
 
+  po4a = perlPackages.Po4a;
+
   podiff = callPackage ../tools/text/podiff { };
 
   podman = callPackage ../applications/virtualization/podman/wrapper.nix { };
@@ -14012,18 +14014,18 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_61 = callPackage ../development/compilers/rust/1_61.nix {
+  rust_1_62 = callPackage ../development/compilers/rust/1_62.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_14 = llvmPackages_14.libllvm;
   };
-  rust = rust_1_61;
+  rust = rust_1_62;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
   mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix { stdenv = gcc10StdenvCompat; };
 
-  rustPackages_1_61 = rust_1_61.packages.stable;
-  rustPackages = rustPackages_1_61;
+  rustPackages_1_62 = rust_1_62.packages.stable;
+  rustPackages = rustPackages_1_62;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -14914,7 +14916,9 @@ with pkgs;
 
   inherit (ocamlPackages) reason;
 
-  buildRubyGem = callPackage ../development/ruby-modules/gem { };
+  buildRubyGem = callPackage ../development/ruby-modules/gem {
+    inherit (darwin) libobjc;
+  };
   defaultGemConfig = callPackage ../development/ruby-modules/gem-config {
     inherit (darwin) DarwinTools cctools;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
@@ -24471,6 +24475,7 @@ with pkgs;
     nlsSupport = false;
     ncursesSupport = false;
     systemdSupport = false;
+    translateManpages = false;
   } else util-linux;
 
   v4l-utils = qt5.callPackage ../os-specific/linux/v4l-utils { };
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 41c507a1aed6e..ce3af252abc74 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -66,8 +66,8 @@ lib.makeScope pkgs.newScope (self: with self; {
   #
   # Build inputs is used for extra deps that may be needed. And zendExtension
   # will mark the extension as a zend extension or not.
-  mkExtension =
-    { name
+  mkExtension = lib.makeOverridable
+    ({ name
     , configureFlags ? [ "--enable-${name}" ]
     , internalDeps ? [ ]
     , postPhpize ? ""
@@ -151,7 +151,7 @@ lib.makeScope pkgs.newScope (self: with self; {
         description = "PHP upstream extension: ${name}";
         inherit (php.meta) maintainers homepage license;
       };
-    });
+    }));
 
   php = phpPackage;